Rundll32 Executing DLL From Remote Network Share

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.