hasherezade / process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

hasherezade/process_ghosting Issues

Blocked by wdfilter?
Updated 10 months ago1
.tmp created
Updated 2 years ago3
Change Process
Updated 2 years ago
License?
Closed 2 years ago2
Crashes my Windows 10 VM
Closed 2 years ago1
The issue of VirtualAllocEx usage
Closed 3 years ago9
Reflective Loader as payload
Updated 3 years ago5
Payload doens't fire
Updated 3 years ago11
In memory file
Closed 3 years ago5
32 Bit Payloads on 64 Bit Systems.
Updated 3 years ago5
build error
Updated 3 years ago5
The PoC produces random result due to the ghosted file being created asynchronous
Closed 3 years ago1