GIAC
GREM · Question #121
You execute the sample in a VM and observe it creates a new process using CreateProcess, then immediately suspends it and modifies its memory. What technique is this?
The correct answer is B. Process hollowing. See the full explanation below for the reasoning.
Question
You execute the sample in a VM and observe it creates a new process using CreateProcess, then immediately suspends it and modifies its memory. What technique is this?
Options
- ADLL injection
- BProcess hollowing
- CAPI hooking
- DThread hijacking
How the community answered
(32 responses)- A16% (5)
- B72% (23)
- C3% (1)
- D9% (3)
Community Discussion
No community discussion yet for this question.