Process hollowing runs malicious code inside a legitimate process. The malware starts a trusted executable in a suspended state, removes the executable's real code from that process's memory, writes its own payload in its place, and resumes the thread. The process keeps the identity, PID, and metadata of the trusted binary, but the code running inside it is the attacker's. It's a defence-evasion and process-injection technique used to make malicious activity look like a normal process such as svchost.exe or explorer.exe.
The Process
The sequence is:
- Create a legitimate process suspended. The malware launches a benign, usually signed, typically Windows binary with the
CREATE_SUSPENDEDflag. The process is created with its memory mapped but no instructions executed. - Unmap the original image. Using
NtUnmapViewOfSectionthe malware unmaps the legitimate executable's image from the suspended process's memory. This leaves the process allocated but without its original code, while still retaining its identity and PID. - Write the payload. The malware allocates memory in the target process (
VirtualAllocEx) and writes its own image into it (WriteProcessMemory), usually at or relocated to the address the original image occupied. - Redirect execution. It updates the suspended thread's context with
SetThreadContextso the thread now points at the injected payload. - Resume.
ResumeThreadstarts the thread. The process now runs the attacker's code while presenting the legitimate binary's name and identity.
The result is a process that matches original executable on every external attribute but executes malware.
Process hollowing provides several evasion benefits at once. It gives masquerading, so malicious activity is attributed to a trusted process and appears normal in the process list. It provides defensive bypass, because products that key off process names and reputation may trust the hollowed process, and application allowlisting is defeated since the permitted executable is the one that was launched. It aids blending and persistence, because the malware sits among the many legitimate instances of common system processes. And it essentially means no malicious file on disk at runtime, since the payload lives in memory inside the legitimate process, which limits file-based scanning in the same way as fileless and living-off-the-land techniques.
Adjacent Techniques
Process hollowing is one member of the process injection family. Related techniques include process doppelgänging (where malware creates a temporary transaction on a legitimate executable, writes malicious data into it, and loads the malicious image into a section of memory. It then rolls back the transaction, leaving the original file on the disk untouched, and creates the process directly from the tainted memory, leaving no trace behind on the disk.), process herpaderping (intentionally writes malicious bytes directly to a real disk file, creates the process, and then actively overwrites that file before the AV can read it), and simpler DLL/shellcode injections. All run attacker code inside another process's context. They differ in how the code is planted and which detections they evade.
Detection and defence
The API sequence used for hollowing is also used to detect it happening:
- Behavioural detection of the pattern: A process created suspended, followed by memory unmapping, remote writes, thread-context changes, and a resume, is a high-confidence indicator that EDR products look for.
- Memory analysis: Comparing a process's in-memory image against its on-disk file exposes the mismatch: the running code does not match the executable it claims to be.
- API call monitoring: Flagging cross-process combinations of
NtUnmapViewOfSection,WriteProcessMemory, andSetThreadContext. - Parent-child anomalies: A legitimate process spawned by an unexpected parent, or behaving unlike its normal self.
Aftermath
Process hollowing shows that a process's name and identity are not evidence of what it is running. It's one of the reasons endpoint security moved away from trusting process reputation and signatures and toward inspecting process behaviour and memory, as process-injection remains central to how malware hides on modern systems.