IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects the execution of rundll32.exe with a command line that specifically loads a DLL named "1.dll" and calls the "DllRegisterServer" export function. This pattern has been observed in malware campaigns, particularly those involving IcedID.