Description

Some malware modify legitimate processes to ensure they remain stealth and persistent.

Pseudo-code explaining process replacement:

CreateProcess(...,"svchost.exe",...,CREATE_SUSPEND,...);
ZwUnmapViewOfSection(...);
VirtualAllocEx(...,ImageBase,SizeOfImage,...);
WriteProcessMemory(...,headers,...);
for (i=0; i < NumberOfSections; i++) {
    WriteProcessMemory(...,section,...);
}
SetThreadContext();
...
ResumeThread();