C2Looper v2 process injection via winspool.drv module

Emiliano Mema@Nosalva

•updated Aug 19, 2026•1•0•3

Detects instances where the Windows spooler driver (winspool.drv) is loaded by a process that subsequently performs suspicious memory operations typical of process injection (e.g., CreateRemoteThreadApiCall, WriteToProcessMemory, ProcessInjection) within a 5-minute window.