rundll32.exe
Summary
RunDLL32 (rundll32.exe) executes DLL files by calling a specified export function. It allows Windows and applications to run code stored in DLLs without a standalone executable. It is one of the most commonly abused LOLBins due to its ability to execute arbitrary code from DLLs.
rundll32.exe is the 53rd most commonly executed Windows program in EchoTrail's dataset, observed 688,660 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System3297.72%
- C:\Windows\SysWOW642.28%
Top Hashes (SHA256)
- b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a654.44%
- b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa8.34%
- 9cc4ddad2e9ae05a8c5762ba88a13c2b1ee4e25ae98ef01dd041fe35d611da876.81%
- 5cc2c563d89257964c4b446f54afe1e57bbee49315a9fc001ff5a6bcb66503936.48%
- 11064e9edc605bd5b0c0a505538a0d5fd7de53883af342f091687cae8628acd05.5%
- 38847dc4c82c0775e7dafcbc7fea50749cdac7b50ab8602e8fdfad4401954c873.72%
- 0bb68e54629555fb9f70fb8d7b95fe1a5f987eeeef57de0a2671eeb14063ced12.4%
- 01b407af0200b66a34d9b1fa6d9eaab758efa36a36bb99b554384f59f8690b1a2.37%
- f1dc9560d0c381c78304d94f7ba469490017d9728a03c2dd32c3be957fc9f9232.17%
- 405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc41.2%
Process Ancestry
Top Grandparents
- services.exe46.34%
- explorer.exe29.91%
- userinit.exe15.18%
- svchost.exe2.36%
- msiexec.exe0.93%
- CompatTelRunner.exe0.76%
- ekrn.exe0.62%
- nvvsvc.exe0.34%
Top Parents
- svchost.exe46.44%
- explorer.exe20.09%
- rundll32.exe19.05%
- spoolsv.exe2.89%
- mstsc.exe1.64%
- wermgr.exe1.27%
- RAVBg64.exe0.82%
- msiexec.exe0.81%
- CompatTelRunner.exe0.61%
Top Children
- rundll32.exe93.71%
- WinSAT.exe3.11%
- dfsvc.exe0.77%
- fsquirt.exe0.38%
- PING.EXE0.26%
- chrome.exe0.15%
- iexplore.exe0.09%
- sdbinst.exe0.08%
- icacls.exe0.08%
- cmd.exe0.07%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does rundll32.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Common parents include svchost.exe, explorer.exe, and spoolsv.exe. Can spawn itself recursively. Used legitimately for control panel applets, shell extensions, and DLL registration.
When is rundll32.exe suspicious?
Running from a non-standard path. Command-line pointing to DLLs in temp directories, user profiles, or download folders. Executing DLLs via URL (rundll32.exe javascript:".."). Spawning shells (cmd.exe, powershell.exe). Making outbound network connections. Command-line referencing unusual export function names. Being launched by Office applications or script interpreters.
How do attackers abuse rundll32.exe?
Proxy execution: attackers use rundll32 to execute malicious DLLs, bypassing application whitelisting since rundll32 is a signed Microsoft binary. JavaScript execution: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication" can execute arbitrary JavaScript. DLL sideloading: placing a malicious DLL where rundll32 will find it. Payload delivery: malware droppers often use rundll32 to execute their DLL payloads. Cobalt Strike and other C2 frameworks frequently use rundll32 for DLL injection and execution.
Detection guidance
High-confidence: rundll32.exe executing DLLs from temp/user profile directories. rundll32.exe with javascript: in the command-line. rundll32.exe making outbound network connections. rundll32.exe spawned by Office applications. Medium-confidence: rundll32.exe with unusual export function names. rundll32.exe loading DLLs not in System32 or known application directories. Monitor Sysmon Event ID 1 (command-line) and Event ID 7 (DLL loads).
False positive notes
Very common in legitimate Windows operations. Shell extensions, control panel applets, and printer drivers use rundll32. explorer.exe launching rundll32 is normal for shell operations. svchost.exe spawning rundll32 for system maintenance is expected. Focus on the DLL path and export function in the command-line rather than rundll32 execution alone.
Related Processes
Ask Rocky about rundll32.exe
Rocky answers questions about rundll32.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.