1. A method comprising: determining, by a processing device, that a block of dynamically allocated memory in an inferior process memory space corresponds to a structure; casting the block of memory as an instance of the structure; determining a field type of a field in the instance of the structure; determining heuristics data that corresponds to the field type; determining whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in the heuristics data that corresponds to the field type; and categorizing the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.