Process Injection is the general category: any technique that gets malicious code executing inside another process's memory.
Process Hollowing is one specific technique inside that category. It creates a process in a suspended state, strips out the original executable image, and replaces it with malicious code before letting the process run.
Every process hollowing attack is a form of process injection, but not every injection technique is hollowing. Hollowing specifically replaces the original executable image. Most other injection techniques just add malicious code alongside an otherwise intact, running process.
| Feature | Process Injection | Process Hollowing |
|---|---|---|
| What is it? | Any technique that executes code inside another process | Replaces the code of a legitimate process with malicious code |
| Creates a new process? | Not necessarily | Yes, almost always |
| Original code remains? | Usually yes | No, it's hollowed out |
| Memory modification | Injects additional code | Unmaps and replaces the executable image |
| Stealth | High | Very high |
The attacker already has a process to work with, either one that's already running or one the malware starts for this purpose.
Typical API sequence:
OpenProcess()
VirtualAllocEx()
WriteProcessMemory()
CreateRemoteThread()The legitimate process keeps running as normal, but now some of its memory also contains attacker code:
explorer.exe
├── Legitimate code
├── Legitimate threads
└── Injected malicious DLL/shellcodeCommon variants: DLL injection, reflective DLL injection, APC injection, CreateRemoteThread injection, and thread hijacking.
Instead of injecting into a process that's already executing, the attacker builds the target from a paused state:
Before hollowing:
notepad.exe (Suspended)
-----------------
notepad.exe
-----------------
After hollowing:
notepad.exe
-----------------
Malware.exe
-----------------To Windows and to the user, it still looks like notepad.exe. In reality it's executing the malware.
Common APIs:
CreateProcess(CREATE_SUSPENDED)
NtUnmapViewOfSection()
VirtualAllocEx()
WriteProcessMemory()
SetThreadContext()
ResumeThread()Attackers favor hollowing because the process name on screen and in tooling appears legitimate (svchost.exe, notepad.exe, explorer.exe), security tools and users tend to trust a process based on its image name, and the malware inherits a legitimate process context.
Hollowing doesn't invent a new kind of process. It uses a legitimate Windows binary as a container and walks through these stages:
Stage 1: Start the legitimate binary suspended.
CreateProcess("C:\\Windows\\System32\\svchost.exe", ..., CREATE_SUSPENDED)Windows allocates the usual process object, virtual memory space, and loaded DLLs, and creates the main thread, but that thread is paused before any code runs.
Stage 2: Remove the original image from memory.
NtUnmapViewOfSection() strips the mapped executable out of the process's address space:
Before: After:
0x400000 0x400000
+----------------+ +----------------+
| svchost.exe | | |
| PE headers | → | empty |
| code sections | | |
+----------------+ +----------------+The process object still exists, but its original code is gone, which is why it's called "hollowing."
Stage 3: Write the malicious image into that space.
VirtualAllocEx()
WriteProcessMemory()Now the memory under the svchost.exe process object holds the malware's PE, code sections, and entry point instead.
Stage 4: Redirect execution.
The main thread's context still points at where svchost.exe's entry point used to be. SetThreadContext() repoints it at the malware's entry point instead.
Stage 5: Resume.
ResumeThread() lets the thread run. Windows reports the process name as svchost.exe, but the code executing is the malware.
Process injection is fundamentally a memory-based technique. The goal is to get code running inside another process's address space in RAM, not to change anything on disk.
Normal:
Disk: explorer.exe, malware.dll
RAM: explorer.exe
After injection:
Disk: explorer.exe, malware.dll (unchanged)
RAM: explorer.exe + injected malicious codeThe injected code executes from RAM. That said, the injector itself usually starts life as a file on disk:
| Component | Location |
|---|---|
| Injector malware | Usually starts from disk |
| Target process | RAM |
| Injected code | RAM |
| Execution | RAM |
This is part of why injection is harder for traditional file-based antivirus to catch: the malicious code may never exist as an ordinary file on disk. Memory forensics tools such as Volatility instead look for unusual memory regions, injected DLLs, and hidden threads.
A common point of confusion: does the malicious code "become" the legitimate process, or does the legitimate process run normally and get invaded afterward? For standard process injection, the malicious code does not become the legitimate process. The injector runs first and forces code into a process that is separate from it.
Scenario 1: Injecting into an already-running process.
User opens explorer.exe normally.
RAM: explorer.exe → legitimate Explorer code
Malware (malware.exe) then runs and does:
OpenProcess(explorer.exe)
→ Allocate memory inside explorer.exe
→ Write malicious code
→ Create remote thread
RAM: explorer.exe → legitimate code + injected malicious codeExplorer is simply being used as a place to execute code. The user still sees explorer.exe, but part of its memory is now malicious.
Scenario 2: The malware creates the target process itself.
malware.exe creates notepad.exe (suspended)
→ injects malicious code into it
→ resumes itThis is functionally close to process hollowing.
Does the legitimate process start normally? Usually yes, for standard injection. The user opens Chrome, chrome.exe starts as expected, and malware injects into it afterward without Chrome being aware.
Does the malicious code run "through" the legitimate process? Yes, once injected. The original injector process may keep running, exit, or simply act as a one-time injector and disappear, while the malicious code continues executing inside the legitimate process's context.
Analogy: think of the malware as a person breaking into a house (the legitimate process).
The general flow: malware executes, injects into (or builds and hollows) a legitimate process, and the malicious code then executes inside that process's context.
Process injection indicators:
Process hollowing indicators: