There is a plugin called HollowFind that combines all of these commands. It finds a suspicious memory space or evidence of a hollowed out process and returns these results, as shown in the following screenshot:
Figure 15: The HollowFind plugin for detecting hollow process injection
This plugin can also dump the memory image into a chosen directory:
Figure 16: The HollowFind plugin for dumping the malware's PE image
So, that's it for process injection and how to analyze it dynamically using OllyDbg (or any other debugger), as well as how to detect it in a memory dump using Volatility.
In the next section, we will cover another important technique that's used by malware authors, known as API hooking. It's usually used in combination with process injection for man-in-the-middle attacks or for hiding malware presence using user-mode rootkits techniques.
