SNOWLIGHT Dropper wusvc.exe Manual Injection via CreateRemoteThread

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects the SNOWLIGHT dropper (wusvc.exe) executing process injection via CreateRemoteThread. The malicious dropper, often found in user-writable directories, mimics the legitimate Windows Update service (wusvc.exe) and utilizes advanced injection techniques, including PEB traversal for API resolution and APC injection, to deploy the VSHELL RAT.