Certified Ethical Hacker (CEH) Practice Question

The observed workflow-creating a legitimate process in a suspended state, unmapping its sections with NtUnmapViewOfSection, copying a malicious PE image over the now-vacant address space, rebuilding the thread context, and resuming execution-is the textbook sequence for process hollowing (often called RunPE). Reflective DLL injection loads a DLL directly from memory without touching disk and does not require unmapping an entire executable image. DLL search-order hijacking substitutes a malicious DLL that a program loads at startup; it does not involve spawning or hollowing another process. QueueUserAPC injection schedules code to run in another thread's context through an APC call rather than replacing the process image.