<ResearchesOpen in GitBook↗
[Memory Forensics]Feb 2026 · 10 min read

Process Hollowing Detection with Volatility 3

Process Hollowing Detection with Volatility 3

Tag: Memory Forensics · Date: Feb 2026 · Read time: 10 min

Process hollowing remains one of the most common defense-evasion techniques employed by sophisticated ransomware and APT payloads. By creating a suspended legitimate Windows process (e.g., svchost.exe or explorer.exe), unmapping its executable memory, and replacing it with malicious payload code, attackers execute under trusted binary names.

In this walkthrough, we dissect a full memory dump containing a hollowed process using Volatility 3, extract the malicious executable, and confirm evasion indicators.

Diagnostic Workflow

Raw Memory Capture
  ├─► windows.pslist / windows.pstree (Find PID anomalies & parentage)
  ├─► windows.malfind (Identify unbacked RWX pages & MZ headers)
  ├─► windows.vadinfo (Inspect memory protection changes)
  └─► windows.dumpfiles (Carve hollowed PE payload to disk)

Step 1: Identifying Process Hierarchy Anomalies

We begin by auditing the process tree to spot orphaned or mis-parented processes:

vol -f win10_infected.raw windows.pstree

Look for:

  • Processes with unexpected parent PIDs (e.g., cmd.exe spawning svchost.exe)
  • Multiple instances of singleton processes (lsass.exe, services.exe)
  • Processes running from abnormal file system paths

Step 2: Running malfind to Locate RWX Injections

The windows.malfind plugin scans virtual memory descriptor blocks (VAD) for memory pages with PAGE_EXECUTE_READWRITE protection that are not backed by files on disk:

vol -f win10_infected.raw windows.malfind --pid 4920

Sample output:

PID   Process         Base Address        Protection             Hexdump
4920  powershell.exe  0x000001dfa2900000  PAGE_EXECUTE_READWRITE 4d 5a 90 00 03 00 00 00 (MZ Header)

Notice the MZ DOS signature (hex 4d 5a) located at an unmapped, dynamically allocated memory page. Legitimate processes map executable memory directly from system disk DLLs or PE files.

Step 3: Carving and Dumping Injected PEs

Once the malicious VAD range is located, we carve the injected binary for static analysis:

vol -f win10_infected.raw windows.dumpfiles --pid 4920 --virtaddr 0x000001dfa2900000

We now have the decompressed, unpacked malware binary ready for hash identification, YARA scanning, and Ghidra disassembly.

Key SOC Analyst Takeaways

  1. Never trust process names alone: A hollowed svchost.exe looks completely benign in basic task manager views.
  2. Prioritize RWX memory alerts: Sysmon EID 10 combined with memory protection changes (0x40 PAGE_EXECUTE_READWRITE) should be high-priority triage alerts in any SIEM.