Process Hollowing (RunPE)

• Run malicious code under the identity of a legitimate program.
• Steps:
• CreateProcess a benign target in suspended state (e.g. svchost.exe).
• Unmap ("hollow out") the original image from its memory.
• Allocate and write the malicious PE into that space.
• Fix the entry point (set thread context / EAX/RCX).
• ResumeThread — the process now runs the malware.
• On disk and in Task Manager it still looks like the trusted binary.