Security scanners often mark it as "suspicious" because it drops executable content and interacts with system processes in a way similar to certain malware.