rundll32.exeRun a DLL as an app

What rundll32.exe does

Many pieces of Windows functionality live in DLLs, which cannot be run directly. rundll32.exe bridges the gap: given a DLL and the name of a function it exports, rundll32 loads the DLL and calls that function, as though the DLL were a program. This is how a number of Control Panel applets and system dialogs are launched. For example, the classic display or mouse settings and some cleanup tasks are DLL functions invoked through rundll32.

Why it can be abused

Because rundll32 will run a function from whatever DLL it is pointed at, malware can use it to execute malicious code while appearing to be a normal Windows process ("living off the land"). This does not make rundll32 itself dangerous, but it means the process name alone tells you nothing; the command line is what matters.

Seeing what it is running

Add the Command line column in Task Manager's Details tab, or use Process Explorer, to see the full invocation:

rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL desk.cpl

A legitimate command line references a DLL inside C:\Windows\System32. Warning signs are a DLL loaded from a temporary folder, a user profile, or AppData; a random-looking function name; or rundll32 with no arguments running continuously.

Confirming it is genuine

• Path of rundll32 itself: C:\Windows\System32\rundll32.exe (or SysWOW64), Microsoft-signed.
• The DLL it loads: inspect the command line; a System32 DLL is expected.

If the command line points somewhere unusual, treat it as a lead and scan the system; see open ports and exposure for the broader investigation mindset.