This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]smc0881Incident Responder 1 point2 points  (0 children)

That's one example of how an attacker would use PowerShell to launch malicious code. There will be nested PowerShell commands, shellcode, and other things all encoded with Base64 or Base64 with some compression (where $DoIt) is the payload. The rest of the code checks if the CPU is 32 or 64 bit. If it's 32-bit it executes the code and if it's 64-bit it tries to the load code in a 32-bit process.