LegionLoader rundll32.exe Loading DLLs from AppData\Roaming via msiexec or cmd

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances of rundll32.exe being spawned by msiexec.exe or cmd.exe where the command line arguments involve loading DLLs from AppData paths, specific libraries like normaliz.dll or 7z.dll, or paths associated with LegionLoader staging activity. This behavior is indicative of malware loaders attempting to execute secondary payloads from writable user directories.