Learning Malware Analysis

3.6 Hollow Process Injection (Process Hollowing)

Process hollowing, or Hollow Process Injection, is a code injection technique in which the executable section of the legitimate process in the memory, is replaced with a malicious executable. This technique allows an attacker to disguise his malware as a legitimate process and execute malicious code. The advantage of this technique is that the path of the process being hollowed out will still point to the legitimate path, and, by executing within the context of a legitimate process, the malware can bypass firewalls and host intrusion prevention systems. For example, if the svchost.exe process is hollowed out, the path will still point to the legitimate executable path (C:\Windows\system32\svchost.exe ...