VERY IMPORTANT

During an analysis we conducted while tracking GandCrab ransomware, one of the more notorious malware families in 2018 and 2019, we noticed an interesting behavior. In some cases, it seemed to have been using Process Hollowing as part of its attack chain.