A more stealthy variant of "DLL hollowing"
A PoC based on the ideas of thewover (twitter @TheRealWover): https://twitter.com/TheRealWover/status/1193284444687392768?s=20 + my own experiments
Using: libpeconv.
MEM_IMAGE
, impersonating a legitimate DLL (image linked to a file on the disk)RWX
)Module32First
/Module32Next
)
Use recursive clone to get the repo together with all the submodules:
git clone --recursive https://github.com/hasherezade/module_overloading.git