LNK ZDI-CAN-25373/CVE-2025-116624 rundll32 ShellExec_RunDLL spawning space-obfuscated PowerShell chain

Ethan Andrews@eandrews

•updated Jul 6, 2026•4•0•8

Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.