Reports containing the tag In-Process Shellcode Execution

3048.ps1

A PowerShell one-liner that unpacks a base64 and gzip encoded stage, which writes shellcode into RWX memory and runs it on a new thread. The shellcode connects to 185.243.115.227 over HTTPS and reads a further payload into executable memory.