Process hollowing: hollow a process and refill it

Process hollowing runs malicious code under the guise of a trusted system process (svchost, notepad).

The flow

CreateProcess("notepad.exe", CREATE_SUSPENDED)
NtUnmapViewOfSection(target, imageBase)  # hollow it
VirtualAllocEx + WriteProcessMemory       # write the malicious PE
SetThreadContext(entry = new EP)
ResumeThread                              # the malware starts

The process keeps the legitimate one's name, path and (often) apparent signature, but runs something else. Good for evading shallow name-based checks.

Defence

EDRs detect the mismatch between the on-disk image and the in-memory one (memory scanning, module stomping detection), processes created suspended followed by unmap/write, and entry-point mismatches. On-disk vs in-memory image comparison is the key countermeasure.