LegionLoader rundll32 Sideload Chain: AppData DLL via msiexec or cmd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious execution chain associated with LegionLoader, where a malicious DLL (e.g., normaliz.dll or 7z.dll) is staged in the AppData\Roaming directory followed by the execution of rundll32.exe spawned by msiexec.exe or cmd.exe to load the staged DLL.