CL-STA-1062 TinyRCT AppDomainManager Injection via chrome_setup.exe to PerfWatson2.exe
Detects a suspicious execution chain where a dropper (chrome_setup.exe) uses an AppDomainManager injection technique to load a malicious DLL, followed by the execution of the TinyRCT payload (PerfWatson2.exe) from the LocalAppData directory. This behavior has been observed in campaigns targeting Southeast Asian government and critical infrastructure.
YARA-L
