Regardless of code correctness, it's easy enough for malware to spoof process relationships.