SharkLoader LdrpLoaderLock Manipulation and Malicious Thread Spawn

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.