Unusual Network Connection via RunDLL32

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and process.name : "rundll32.exe" and process.args_count == 1 and
   not (process.code_signature.subject_name == "Teramind Inc." and
        process.code_signature.trusted == true and process.Ext.token.integrity_level_name == "system" and
        process.args == "/update" and process.parent.name == "tmagentsvc.exe") and
   not process.args : "C:\\Windows\\system32\\rundll32.exe  *,*"]
  [network where event.action == "connection_attempted" and process.name : "rundll32.exe"]