Blocked Exploit Attempt?

[shimashi]

What is this? Is this a false positive and should I be worried?

[Porthos]

4 minutes ago, shimashi said:

What is this? Is this a false positive and should I be worried?

Please post the log.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[shimashi]

OK, this is the log.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 10/9/22
Protection Event Time: 9:56 AM
Log File: 6d4f8102-475c-11ed-a6a0-000000000000.json

-Software Information-
Version: 4.5.14.210
Components Version: 1.0.1772
Update Package Version: 1.0.60787
License: Trial

-System Information-
OS: Windows 10 (Build 19043.2006)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe Shell32.dll,Control_RunDLL input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}{HOTKEYS}, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Windows Control Panel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office loading points abuse blocked
File Name: C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe Shell32.dll,Control_RunDLL input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}{HOTKEYS}
URL: 

(end)

[Porthos]

You seem to have been using hotkeys to access input and display language settings in Windows.

It is a FP.

Malwarebytes is getting more aggressive on Anti Exploit protection.

Uncheck the following box under MS Office.

[shimashi]

Thank you so much! I was indeed just trying to remove a language hotkey as it happened, I didn't mention it as I didn't think that would be the cause.

Thanks for the response.