Potential Evasion via Oversized Image Load

sequence with maxspan=1m
 [file where event.action != "deletion" and
   /* over 100MB in size */
   file.size >= 100000000 and file.Ext.header_bytes : "4d5a*" and not file.extension : "exe" and
   not user.id : "S-1-5-18" and
  not (process.code_signature.subject_name in ("Trend Micro, Inc.",  "Azul Systems, Inc.", "Wargaming Group Limited",
      "Avigilon Corporation", "Duck Duck Go, Inc.", "Wargaming Group Limited", "Griff Gate Pte. Ltd.", "Corsair Memory, Inc.",
      "Anaconda, Inc.") and
       process.code_signature.status == "trusted") and
  not process.executable : ("C:\\ProgramData\\slicer.org\\Slicer *\\bin\\python-real.exe", "C:\\Program Files\\burpsuite_enterprise\\jres\\*\\bin\\java.exe") and
  not file.path : "C:\\ProgramData\\*\\PyQt5\\Qt5\\bin\\Qt5WebEngineCore.dll"
  ] by file.path
 [library where
    (
     process.name : ("rundll32.exe", "regsvr32.exe", "svchost.exe") or
     process.executable :
               ("?:\\Users\\Public\\*",
                "?:\\ProgramData\\*",
                "?:\\Windows\\Temp\\*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
     )
    and not dll.code_signature.trusted == true and
    not dll.code_signature.status : "errorExpired" and
    not user.id : "S-1-5-18" and
    not (process.name : "regsvr32.exe" and dll.path : "C:\\Oracle\\*.dll") and
    not (dll.name : "Qt5WebEngineCore.dll" and process.code_signature.subject_name == "Pitney Bowes Inc.")] by dll.path