RunPE

Hiding code behind legit processes

References

• https://www.adlice.com/runpe-hide-code-behind-legit-process/

• https://labs.nettitude.com/blog/introducing-process-hiving-runpe/

• https://www.malwarebytes.com/glossary/runpe-technique

• https://itm4n.github.io/vba-runpe-part1/

• https://itm4n.github.io/vba-runpe-part2/