I recently had to read over some malware reports and associated logs for a confirmed malware detection and subsequent infection of a Windows asset. The logs clearly show
.dll files in a user’s
AppData folder. These
.dll files are named the same as
.dlls normally found in
I know that in this specific instance this was definitely malware and the unpacking of the rogue
.dlls was part of the malware's normal process.
I asked about this in chat and was told that the only real credible explanation for this behaviour would be malware (as it was in this instance) or very bad programming practice, and even in that case it is a scenario that is rare.
My question is twofold; is there a scenario where
.dll files with the same name as standard
.dlls be found in an user's
AppData folder for any reason other than malware or poor programming?
In addition, is it fair to treat
.dll files that are found in
AppData and appear to be copies of
.dll files in
system32, as an indicator of compromise?