An unauthorized user replaces sections of a running program’s memory so it retains the same identity and runs harmful instructions. Which approach best describes this technique?
This approach relies on substituting memory regions of a running program with harmful code while continuing to use the program’s identity in the operating system. Another method, library injection, focuses on forcing legitimate programs to load an unwanted library. Kiosk escape deals with leaving a restricted interface, and unquoted service path replacement exploits path resolution in services. The stated approach specifically swaps parts of memory in a live process.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is process hollowing and how does it work?
Open an interactive chat with Bash
How does process hollowing differ from library injection?
Open an interactive chat with Bash
What are common detection techniques for process hollowing?