https://en.wikipedia.org/wiki/Heuristic_analysis
https://en.wikipedia.org/wiki/Static_program_analysis
https://en.wikipedia.org/wiki/Sandbo...e_development)
You can't just flag every program that reads another's memory. Almost any windows based application uses some form of process reading. ( Overlays to games, plugins to applications etc. ) So the above techniques are used in conjunction.