That seems like an obvious oversight. This is a well known and widely used malware technique. https://attack.mitre.org/techniques/T1053/003/