rundll32.exe
Sources: 300M+ executions observed in the wild.
Summary
RunDLL32 (rundll32.exe) executes DLL files by calling a specified export function. It allows Windows and applications to run code stored in DLLs without a standalone executable. It is one of the most commonly abused LOLBins due to its ability to execute arbitrary code from DLLs.
rundll32.exe is the 53rd most commonly executed Windows program in EchoTrail's dataset, observed 688,660 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Get this in your tools
The same record for rundll32.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/rundll32.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3297.72%
- C:\Windows\SysWOW642.28%
Top Hashes (SHA256)
- b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a654.44%
- b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa8.34%
- 9cc4ddad2e9ae05a8c5762ba88a13c2b1ee4e25ae98ef01dd041fe35d611da876.81%
- 5cc2c563d89257964c4b446f54afe1e57bbee49315a9fc001ff5a6bcb66503936.48%
- 11064e9edc605bd5b0c0a505538a0d5fd7de53883af342f091687cae8628acd05.5%
- 38847dc4c82c0775e7dafcbc7fea50749cdac7b50ab8602e8fdfad4401954c873.72%
- 0bb68e54629555fb9f70fb8d7b95fe1a5f987eeeef57de0a2671eeb14063ced12.4%
- 01b407af0200b66a34d9b1fa6d9eaab758efa36a36bb99b554384f59f8690b1a2.37%
- f1dc9560d0c381c78304d94f7ba469490017d9728a03c2dd32c3be957fc9f9232.17%
- 405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc41.2%
Process Ancestry
Top Grandparents
- services.exe46.34%
- explorer.exe29.91%
- userinit.exe15.18%
- svchost.exe2.36%
- msiexec.exe0.93%
- CompatTelRunner.exe0.76%
- ekrn.exe0.62%
- nvvsvc.exe0.34%
Top Parents
- svchost.exe46.44%
- explorer.exe20.09%
- rundll32.exe19.05%
- spoolsv.exe2.89%
- mstsc.exe1.64%
- wermgr.exe1.27%
- RAVBg64.exe0.82%
- msiexec.exe0.81%
- CompatTelRunner.exe0.61%
Top Children
- rundll32.exe93.71%
- WinSAT.exe3.11%
- dfsvc.exe0.77%
- fsquirt.exe0.38%
- PING.EXE0.26%
- chrome.exe0.15%
- iexplore.exe0.09%
- sdbinst.exe0.08%
- icacls.exe0.08%
- cmd.exe0.07%
Security Analysis
What does rundll32.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Common parents include svchost.exe, explorer.exe, and spoolsv.exe. Can spawn itself recursively. Used legitimately for control panel applets, shell extensions, and DLL registration.
When is rundll32.exe suspicious?
Running from a non-standard path. Command-line pointing to DLLs in temp directories, user profiles, or download folders. Executing DLLs via URL (rundll32.exe javascript:".."). Spawning shells (cmd.exe, powershell.exe). Making outbound network connections. Command-line referencing unusual export function names. Being launched by Office applications or script interpreters.
How do attackers abuse rundll32.exe?
Proxy execution: attackers use rundll32 to execute malicious DLLs, bypassing application whitelisting since rundll32 is a signed Microsoft binary. JavaScript execution: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication" can execute arbitrary JavaScript. DLL sideloading: placing a malicious DLL where rundll32 will find it. Payload delivery: malware droppers often use rundll32 to execute their DLL payloads. Cobalt Strike and other C2 frameworks frequently use rundll32 for DLL injection and execution.
Detection guidance
High-confidence: rundll32.exe executing DLLs from temp/user profile directories. rundll32.exe with javascript: in the command-line. rundll32.exe making outbound network connections. rundll32.exe spawned by Office applications. Medium-confidence: rundll32.exe with unusual export function names. rundll32.exe loading DLLs not in System32 or known application directories. Monitor Sysmon Event ID 1 (command-line) and Event ID 7 (DLL loads).
False positive notes
Very common in legitimate Windows operations. Shell extensions, control panel applets, and printer drivers use rundll32. explorer.exe launching rundll32 is normal for shell operations. svchost.exe spawning rundll32 for system maintenance is expected. Focus on the DLL path and export function in the command-line rather than rundll32 execution alone.
Related Processes
Ask Rocky about rundll32.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for rundll32.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.