Charmap.exe DLL Sideloading Suspected

Kaung Khant Ko@kaungkhantko

•updated 25 days ago•1•0•5

Detects instances where the legitimate Windows Character Map utility (charmap.exe) is spawned by suspicious processes or PowerShell, and subsequently loads clr.dll. This behavior is indicative of potential DLL sideloading or process injection techniques used by malware to execute arbitrary code within a trusted system process context.