Process hollowing replaces or alters the image of a newly created, suspended Windows process with attacker-controlled code, redirects its primary thread to the replacement code, and resumes the thread. The code then runs inside the target process; the technique itself does not grant additional privileges.
Variant:
Execute Arbitrary Commands via Shell
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER