INTRODUCTION
Today, we are going to be diving into Process Hollowing, a cyber attack technique used by hackers to introduce and run malware into a victim machine.

In this article, you'll learn how it works, how to detect it on your system, and go through a practical carried out to detect Process Hollowing.

Before beginning the article, a huge thank you to HSC Consult for the mentorship efforts on this journey.

HOW DOES PROCESS HOLLOWING WORK?
On a very high level, this is just a bad untrusted process pretending to be a trusted process, in order to avoid detection systems. As a user, you could be seeing a notepad process running. Normal, right? Wrong! Someone made it look like a notepad process, but it really is malware running on your system.

Process Hollowing starts up a new program that is known and trusted, and right before the program executes, the attacker finds where the program code sits in memory, writes over the code with new code, and then executes the process. That way, when the trusted program fully executes, it executes the injected malware.

Just as an example, let's say that the trusted process is notepad.exe, a tool used very frequently on Windows system.

HOW RAM CAN BE USEFUL IN DETECTING PROCESS HOLLOWING
When this happens, memory analysis is very helpful in detecting this technique. Note that Process Hollowing can be classified as 'Living-off-the-land' (LOTL) attack, since it makes use of legitimate processes (Read more on LOTL here).

To understand how RAM is useful here, let's review how RAM works.

RAM is the short-term working memory of the computer. What does that even mean? Well, think about this analogy:

• Say you wanted to have breakfast in the morning. You think "Let me warm some bacon and toast on the pan", and then "The heat is too much... there, much better!", "All done. It's smells so good", "Wow, that was delicious, I was so hungry!"
• Once you're done with breakfast, you leave the pan and plate in the sink to clean later.
• If I walked into your kitchen and find the pan and plate in the sink, that will be enough evidence to tell me that you ate breakfast today.

Well, sometimes when attacks happen, there exists the typical evidence that tells us that someone did something, just like the dishes in the sink. This often appears as malicious files within the computer storage. But what if they don't leave a file behind? What if they clean up the sink after breakfast? In that case, we can search the memory for 'thoughts', such as the thoughts you had while having bacon and toast for breakfast. Those thoughts tell us what you did sequentially, what you ate, when you ate it and that you actually enjoyed breakfast. RAM works the same way; it logs the processes within the computer as they are happening, regardless of whether there is evidence on the disk or not.

One thing to remember about RAM is that it is volatile (can be lost very easily). RAM requires continuous power to maintain data. During a forensic investigation, never switch off the computer! Capture RAM first, before the computer is powered off. If the power goes off, you lose your treasure.

PRACTICAL
The Volatility is a supreme tool for memory analysis! Once you have the captured RAM, you can generate a couple of reports using the tool, which you'll analyse for the threat landscape.

For this practical, 3 reports were analysed:

1. pstree_output.txt (Process Tree Analysis)
2. malfind_results.txt (Memory Injection/In-memory artifacts)
3. netscan_results.txt (Network Connection artifacts)

Analysis of Parent-Child Process Hierarchy
The pstree_output.txt report maps out all running processes and their parent-child relationships, helping you spot processes spawned by unusual or unexpected parents.

The goal here is to confirm that each active process came from a valid parent in order to create a baseline of system integrity. Every entry was compared to the Parent Process ID (PPID) standard Windows architectural expectations.

Process ..... PID .... Parent Process .... PPID .... Is this normal?
svchost.exe .... 720 .... services.exe .... 512 .... Yes
svchost.exe .... 884 .... services.exe .... 512 .... Yes
svchost.exe .... 3880 .... notepad.exe .... 2250 .... No!

svchost.exe is a standard Windows system process, completely legit. It seems that the third svchost.exe was spawned by the parent process notepad.exe, which is very unusual and suspicious.

Analysis of the Network Connections
The detected PID 3880 was cross-analyzed using grep CLI command across the remaining forensic datasets. The results showed one entry each within the other reports.

The netscan_results.txt report lists all active and recently closed network connections, showing which processes are communicating externally and on what ports.

PID 3880 in the networkscan file indicates that the process is communicating outside of the local network and is linked to an active, established connection to an external host. Looking at the report, there was an external IP connection, with Port of destination: 443 (HTTPS) and State of Connection: Established.

Using Port 443 enables the malicious communication to evade perimeter firewall inspections and interact with legitimate online traffic. This established relationship demonstrates that the process is actively controlled by an outside party rather than just being inactive, Command & Control (C2) in action!

Malware Analysis and Memory Artefacts
The malfind_results.txt report scans memory regions for suspicious executable code, flagging areas with RWX permissions or embedded PE headers that suggest injection.

svchost.exe (PID 3880) showed an indicator of a malicious payload; it showed indicators of injected shellcode or a reflective PE (Portable Executable) loader in the existence of RWX memory. This means that the file had read, write and execute permissions, which is very unusual. PAGE_EXECUTE_READ or PAGE_READONLY is the architectural standard for a common system component such as svchost.exe.

Magic Bytes were found at the beginning of the memory section after more examination of the PID 3880 raw hexadecimal data:
Header in Hex: 4d 5a
Translation of ASCII: MZ

These bytes are the Windows Portable Executable (.exe) Magic Header, a raw executable header residing unbacked in the memory space of the running process, indicating that a malicious binary has been loaded straight into the RAM of PID 3880.

CONCLUSION
Process Hollowing is a sneaky technique, but it's not unbeatable. As we saw in the practical, memory analysis using Volatility can expose the attack through a combination of clues — an unusual parent-child process relationship, an active C2 connection, and RWX memory regions containing a raw PE header. You can use Volatility to get more clues! No single indicator tells the full story, but together they paint a clear picture of compromise. The takeaway? Always capture RAM before pulling the plug, and let the memory do the talking. The attacker may have skipped leaving files on disk, but the "thoughts" in RAM gave them away.