Windows Rundll32 with Non-Standard File Extension

Kaung Khant Ko@kaungkhantko

•updated Apr 9, 2026•2•0•168

This analytic identifies the instance of rundll32.exe process loading a non-standard Windows modules file extension. This behavior is not common and can be associated with malicious activities. This technique is to evade possible detection by security tools that monitors a suspicious dll loading activity.