rundll32 talking to the internet every minute
Use Volatility’s netscan, cmdline, and dlllist plugins to tie an outbound connection to the rundll32 process behind it and the DLL it loaded from a user profile.
Briefing
Proxy logs show a workstation connecting to 45.77.120.14:8443 once a minute since 10:49. The machine was captured live; the image is cases/ws-ali/ws-ali.vmem.
windows.netscan lists sockets with their owning PID. windows.cmdline and windows.dlllist --pid <n> show what that process is really running.
forensics-ws · Memory forensics
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.