ImprovedReflectiveDllInjector

rule ImprovedReflectiveDllInjector {
     meta:
         comment1 = "Lazarus - 1fc8fb396a22f98c1230d0d8877f3806d52c1a2723add033223753f83628c826"
         comment2 = "Ramsay - 10278770a9c331d0903dde91e714d395a1242101f40ae6030436ce07ff5fcaf6"
         author = "polarply"
     strings:
         $s1 = "DLL and target process must be same architecture"
         $s2 = "Allocated memory address in remote process: 0x%p"
         $s3 = "Could not get reflective loader offset"
     condition:
         1 of them
 }