Closed rotarydrone closed 1 year ago
Clarification - the target process isn't left lingering so it also seems to crash. I haven't debugged much so far.
Question do you only see 3 debug statements are there more?
Just those three before the loader and target process crash
It has to do with your path try C:\Windows\System32\notepad.exe
instead of C:\Windows\notepad.exe
Right, it was failing wither way. But... I was running it from a read-only shared folder in my VM. Copying to C:\ drive and everything works fine. Close as "operator error"? 😄
Test system is Windows 10 10.0.19045 Build 19045. Loader hangs then crashes before injecting remote process, the last debug message printed is "Creating Handle to Remote Process". No AV/EDR, this is a testbed VM with Defender ripped out.
Used beacon/calc shellcode for testing: