4 ms·
I admit that I am reading into the line "abnormal memory allocation and execution" and thinking it's intentional. You are right that they don't seem to know wh
by novaleaf 8y ago
I admit that I am reading into the line "abnormal memory allocation and execution" and thinking it's intentional.
You are right that they don't seem to know what code was being executed. Just that some code (be it real code or random garbage) was injected and executed.
- monocasa 8y agoIt's intentional; it's not "exploitation". It's really doing privilege deescalation of the shellcode. They know the code it's running for the most part, it's the CreatProcessW stuff they talk about.