Reflective DLL injection stages a DLL with a self-mapping loader in a separate live Windows process. The reflective loader maps the image from memory, resolves its imports and relocations, and invokes its entry point instead of asking LoadLibrary to load the target DLL by path. Code then runs in the target process context; this may support privilege escalation when the target is more privileged, but it does not inherently elevate the injector.
Variant:
Spawn a Beacon using DLL application-directory hijacking
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER