SPECTRALVIPER DLL Side-Load and Process Injection via IntelAudioService.exe into OneDrive.Sync.Service.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious process execution pattern where 'IntelAudioService.exe' is executed with specific command-line arguments, followed by network connection activity from 'OneDrive.Sync.Service.exe' on the same host within a 2-hour window. This is a common pattern for DLL side-loading to initiate command and control (C2) communication using a legitimate-looking process.