VirusTotal/sandbox behavioral analysis shows process injection, sandbox evasion, and network C2-pattern activity

[fadedlab]

I ran the resulting binary through VirusTotal for a routine check before running it, and wanted to flag the results since they seem inconsistent with the README's description of the tool's behavior.
Static detection: 1/69 engines flagged it (MaxSecure, Trojan.Malware.300983.susgen, a generic heuristic label). I understand this alone is likely a false positive common for unsigned patcher tools.
Behavioral sandbox (Zenbox), however, showed more specific findings:

Process Injection (T1055) — 5 instances
Sandbox/Virtualization Evasion (T1497)
Impair Defenses (T1562)
Command and Control: Application Layer Protocol (T1071) + Encrypted Channel (T1573)
A Sigma rule match: "Unsigned Image Loaded Into LSASS Process"
Behavior tags: obfuscated, calls-wmi, detect-debug-environment

This seems to contradict the README's claim that the tool "operates strictly locally, does not require internet access, and makes zero network requests." I searched the C# source myself and only found Process.GetProcessesByName() calls and file-based patch logic in Enhancer.cs/AsarSharp, nothing that obviously explains process injection or network activity, but I may be missing something in a native/compiled dependency or something introduced at build time.
Could you help clarify:

Is there a legitimate reason the tool would show process injection or network C2-pattern behavior in a sandbox?
Has this been reported/investigated before? (I found a couple of VirusTotal comment threads with similar reports, but no technical explanation.)
Is there a way to verify that the GitHub Actions build pipeline hasn't been compromised (e.g., via a poisoned dependency)?

Happy to share the full VirusTotal/Zenbox report links if useful. Thanks for maintaining this project, just want to make sure this is understood before more people build and run it.