OXLOADER dui70.dll module-stomping copy created outside System32/SysWOW64

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the creation or modification of a file named 'dui70.dll' (or variants if renamed) within non-standard, user-writable directories such as AppData or Temp. This behavior is indicative of malware, specifically the OXLOADER payload, preparing for module-stomping by placing a malicious DLL copy outside legitimate Windows System32 or SysWOW64 paths.