[SANS ISC] From RunDLL32 to JavaScript then PowerShell

Malware News
1

I published the following diary on isc.sans.edu: “From RunDLL32 to JavaScript then PowerShell“:

I spotted an interesting script on VT a few days ago and it deserves a quick diary because it uses a nice way to execute JavaScript on the targeted system. The technique used in this case is based on very common LOLbin: RunDLL32.exe. The goal of the tool is, as the name says, to load a DLL and execute one of its exported function:

C:\> rundll32.exe sample.dll,InvokedFunction()

Many Windows OS functions can be invoked through RunDLL32… [Read more]

1024×491

The post [SANS ISC] From RunDLL32 to JavaScript then PowerShell appeared first on /dev/random.

Article Link: [SANS ISC] From RunDLL32 to JavaScript then PowerShell - /dev/random