Comment by anaisbetts

I'm surprised the call to WriteProcessMemory or creating suspended processes isn't being picked up, it usually gets you a lot of points on the "Detect binary as malware heuristic" detector