Process Hollowing

Introduction

Code and executables download: From GitHub

Process Hollowing is a technique that modifies a running trusted process. The changes made are at minimum the following:

• spawn a new suspended process
• unmap the content of the previous process to leave an “empty” suspended process
• remap the suspended process to a malicious payload
• resume the target process, which will execute the malicious process

A fantastic and very in-depth resource on Process Hollowing can be found here: https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection