1. A method for detecting an attempted exploit of a vulnerability of an application executed by a computer, comprising: hooking an application programming interface (API) of the application; monitoring for a call made to the hooked API; analyzing a parameter of the call to identify data existing within the address space of the application before the call is made referenced by the parameter of the call; analyzing the referenced data existing within the address space of the application to determine whether the parameter has a malicious characteristic indicating that the call is an attempt to use the data existing within the address space of the application to execute malicious software (malware); and performing a remediation action responsive to a determination that the parameter has the malicious characteristic.