It uses 6 megabytes of memory
1) That's just the loader; it forks other crap.
2) I wouldn't be surprised if Symantec was hooking the OS API to report smaller footprint or gaming the profiling infrastructure in another way. Crap like that has been going on since the 80s.