Suspicious Process Spawn for APC Injection (DeepLoad Malware)

Kaung Khant Ko@kaungkhantko

•updated Mar 31, 2026•3•0•87

Detects PowerShell unexpectedly spawning specific built-in Windows processes (LockAppHost.exe, makecab.exe, Magnify.exe). DeepLoad uses Add-Type compiled C# to inject into these processes to hide its fileless payload via asynchronous procedure call (APC) injection.