.NET Loader - Rundll32 Executing High-Entropy Exports

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Identifies rundll32.exe executing payloads where the exported function name is highly anomalous (over 10 characters, randomized alphanumeric), typical of packed loader DLLs.