Hollow Process and VMware ThinApp

Question

Hi, 
 I have an application created using VMware ThinnApp. Something like a portable application. The last few days I have been getting the application blocked on HollowProcess. Unfortunately the application is quite important for me and I need to run it, but even if I put it in exceptions it doesn't work. It doesn't work even if I shut down the whole Endpoint. 
 
 Has anyone had the same experience? 
 
 best regards 
 Michal

Qoosh · Accepted Answer

Based on the type of detection that was raised, you will need to create an Exploit Mitigation Exclusion. You can find more information on how to do this in the following article. - Exploit mitigation exclusions 
 I suggest checking the "Details" button as shown in the screenshot below, as this will typically contain more information on the detection. You can also create the exclusion from the UI that opens.