HijackLoader Process Hollowing of NeuroManag.exe to Deliver Vidar v2.1
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
YARA-L
