Process hollowing is an AV evasion technique that involves starting a normal process and immediately suspending it. The process resumes after its program image is replaced with a malicious one.