Executable launches a DLL disguised as a temporary data file
A sandbox process tree traces a Windows executable through a script and batch command to `rundll32.exe`, while a dropped-file hash identifies the temporary `.dat` file as a DLL. Separate analyses associate the executable and DLL with the same historical network destination, but do not establish a completed command-and-control exchange.
A Windows executable launched a script, the script launched a batch command, and that command invoked rundll32.exe against a temporary file named helpobj.dat. The filename suggests data; the command treats it as executable code. What was the executable actually putting into motion—and how far can the records connect that activity to an external destination? The evidence reviewed by CTX Threat Intelligence answers the first question unusually well.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read