Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
Read the full analysis on IntelFusions