Vba-runpe

VarPtr requires VBA 7 (Office 2010+) and Allow bypass key reference → usually you must enable "Trust access to the VBA project object model" or use other tricks.

' Process creation and memory management Declare PtrSafe Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (... Declare PtrSafe Function VirtualAllocEx Lib "kernel32" (... Declare PtrSafe Function WriteProcessMemory Lib "kernel32" (... Declare PtrSafe Function CreateRemoteThread Lib "kernel32" (... vba-runpe

Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" ( _ ByVal dest As LongPtr, ByVal src As LongPtr, ByVal size As Long) As LongPtr VarPtr requires VBA 7 (Office 2010+) and Allow

CreateProcessA : To start the sacrificial process in a suspended state. Declare PtrSafe Function WriteProcessMemory Lib "kernel32" (

This technique combines the stealth of process injection with the accessibility of Office macros. It allows raw shellcode (or an EXE) to be injected directly into a remote process—entirely from within a VBA macro, with never a .exe file written to the hard drive.