OXLOADER dui70.dll Stomping — Random .ocx Dropped to %TEMP% by Temp-Resident Process
Detects the OXLOADER malware dropping a renamed copy of dui70.dll with a malicious RWX .xtext section into the user's Temp folder, followed by the loader process reading mpr.dll, which is a known behavior related to its sandbox check and API resolution execution chain.
YARA-L
