CountLoader taskType 3: rundll32.exe execution of DLL correlated with recent user-profile file write

Duo Tech@duotech

•updated Aug 6, 2026•3•0•1

Detects rundll32.exe executing a DLL located in a user-profile directory (Users, AppData, or Documents and Settings) shortly after that same DLL file was created or written, consistent with CountLoader's taskType 3 DLL delivery and execution behavior.