.NET Loader - Rundll32 Executing High-Entropy Exports

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Identifies rundll32.exe executing payloads where the exported function name is highly anomalous (over 10 characters, randomized alphanumeric). This behavior is often associated with malware loaders attempting to evade detection by using dynamically generated or obfuscated export names.