rundll32 DavSetCookie Command - What is normal?

So this is something I’ve seen used numerous times for malicious use, and I was wondering if there are cases where the same activity is legitimate - and if so, how often?

What I’ve seen is svchost being utilized to give a computer access to remote resources, with the command line [C:\WINDOWS\system32\svchost.exe -k LocalService -p -s WebClient]. What usually spawns next is rundll32.exe, running the command line [rundll32.exe C:\WINDOWS\system32\davclnt.dll,DavSetCookie @ http://address/].

Usually this rundll32.exe command contains the IP address, port, …

address cases command cybersecurity ip address malicious normal port rundll32 what is