Mavinject.exe

Used by App-v in Windows

Paths

  • C:\Windows\System32\mavinject.exe
  • C:\Windows\SysWOW64\mavinject.exe

Commands

Execute

Inject evil.dll into a process with PID 3110.

Use case: Inject dll file into running process

Privileges: User

MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

ADS

Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172

Use case: Inject dll file into running process

Privileges: User

Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll

Detection

Resources