OceanLotus IntelAudioService.exe DLL Sideload of DtlCrashCatch.dll
Detects the execution of IntelAudioService.exe (a common masquerade for dtlupdate.exe) which loads a malicious DtlCrashCatch.dll from an AppModel StateRepository directory, a technique historically associated with the OceanLotus (APT32) threat actor.
YARA-L
