a2.cmd stages DarkMe loader via rundll32 undersets.dll RunDllEntryPointW

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects execution of potentially malicious scripts (a2.cmd) or unusual DLL loading behavior via rundll32.exe. This activity is often associated with staging or executing malicious payloads using non-standard naming conventions.