Hollow process injection (process hollowing) is an advanced technique that was introduced in Stuxnet malware before it became popular in the APT attacks domain. Process hollowing is simply a matter of removing the targeted process's PE memory image from its virtual memory and replacing it with the malware executable file.
For example, the malware creates a new process of svchost.exe. After the process is created and the PE file of svchost is loaded, the malware removes the loaded svchost PE file from its memory and then loads the malware executable PE file to the same place and executes it as a svchost process.
This mechanism completely disguises the malware executable in a legitimate coat as the Process Environment Block (PEB) and the equivalent EPROCESS object still hold information about the legitimate process. This helps malware to bypass firewalls and memory forensics tools.
The process of this form of code injection is quite different...
