Is there any special reason why malware sometimes opts for process hollowing vs injection? They seem to achieve the same result, yet dll injection with createRemoteThread is much easier to implement and maintains the original process' code which may help hide it more. Whats the benefit?
A forum for reverse engineering, OS internals and malware analysis
Have no idea what is the "hollowing" you refering. Idiotic term from "security experts"?
Ring0 - the source of inspiration
Yes, the article describes the technique Im referring to. Maybe there is no benefit...just another technique
Oh you mean zombie process. The only benefit is AV/FW bypass. This applies to the use of any non-CreateRemoteThread methods.
Ring0 - the source of inspiration
ah ok. thanks guys.