executed  by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”.  also executed a .dll for a first stage dropper using rundll32.exe. An  loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.