Process Hollowing is when a malware program creates a copy of a legitimate process in memory, then replaces the legitimate process with itself. This allows the malware to run undetected because it appears as if the legitimate process is still running.