1. A method for determining, by a security application, whether an examined process code on a host computer is a malware, comprising the steps of: a. detecting by said security application whenever said examined process code performs an invocation activity that is an attempt to i. cause said examined process code to persist on said host computer by trying to permanently install said examined process code on said host computer, or ii. cause said examined process code to be part of a startup sequence; b. detecting a call site, being a site of an instruction within said examined process code, from which said invocation activity has been launched; c. analyzing one or more pieces of code selected in specific relation to said site from a surrounding area of said site; d. comparing at least a part of the properties of the analyzed pieces of code with a predefined software code pattern associated with malware and determining whether said examined process code corresponds to said predefined software code pattern; and e. classifying said examined process code as malware where the results of the comparing indicate that said examined process code corresponds to said predefined software code pattern.