hard20 pts · first answer countsedralert-triagethreat-hunting

rundll32 with no arguments

EDR shows rundll32.exe running with no command-line arguments, making HTTPS connections to an uncommon external IP. Why is this highly suspicious?

A.Legitimate rundll32 always needs a DLL and entry point; a bare process with network traffic is typical of injected C2 implants that spawn it as a sacrificial processB.rundll32 is a third-party tool that should never be on WindowsC.It means Windows Update is downloading patchesD.rundll32 cannot make network connections, so the EDR is wrong

Discussion 0

Join free to post in the discussion.

rundll32 with no arguments

Discussion 0

Related questions