Tracking Process Hollowing Malware Using EDR

AhnLab Security Emergency response Center (ASEC) once released a report on the types and distribution trends of .NET packers as shown in the post below. As indicated in the report, most .NET packers do not create actual malicious executables hidden via packing features in the local path, injecting malware in normal processes to run them instead. 

.NET packers are being exploited as initial distribution files or as mid-process loaders …

ahnlab asec center distribution edr emergency features hidden hollowing local malicious malware malware analysis path process processes process hollowing report response run security tracking trends types