SPECTRALVIPER DtlCrashCatch.dll Sideload and Reflective Injection into OneDrive Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.