SharkLoader DLL Sideloading via SystemSettings.exe Loading SystemSettings.dll from APPDATA

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.