common-unpacking-techniques

Below are some of the common techniques used when a malware unpacks itself:
1. Process injection: Here the malicious sample injects malicious code into a legitimate process running on the system. 

2. Self-extraction: Some packed malware may have a built-in self-extraction mechanism that unpacks the payload directly into memory.

3. RunPE: Malware may use the "RunPE" technique to create a new process and inject the unpacked code into that new process, rather than into an existing one.

4. Return-Oriented Programming (ROP): In some advanced cases, malware may use ROP chains to dynamically construct the unpacked code in memory without a separate injection step.

5. In-memory loaders: Malware might be designed to have its loader code that unpacks and executes the payload entirely in memory without writing the unpacked payload to disk.

However, the specific method depends on the malware authors and techniques used to pack the malware