Malware can use various Windows API calls for process injection, including:

- CreateRemoteThread: This API creates a thread within the address space of another process, which can be used to execute malicious code in the context of the target process.

- VirtualAllocEx: This API is used to allocate memory within the address space of another process. Malware can use this API to allocate memory for its code and then execute it in the target process.

- WriteProcessMemory: This API is used to write data to the memory of another process. Malware can use this API to write its code into the memory of the target process.

- SetThreadContext: This API is used to set the context of a thread, which includes its registers and other execution state. Malware can use this API to hijack a thread in the target process and execute its code in the context of that thread.

- CreateRemoteThreadEx: This API is similar to CreateRemoteThread but provides additional options for configuring the new thread, such as setting its security attributes. Malware can use this API to create a new thread in the target process with custom security attributes that allow it to execute its code.

It's worth noting that these APIs are also used by legitimate software for various purposes, so their presence alone doesn't necessarily indicate the presence of malware. However, the combination of multiple process injection techniques can be a strong indicator of malicious activity.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence