Skip go content

rundll32.exe

Windows ProcessMicrosoft Corporation

Catalog search terms rundll32, run a dll as an app

WindowsSystem Component

Run a DLL as an App. E dey load exported function from DLL. Na di command line, no be di filename, dey tell wetin e dey do.

Wetin you need know

Di exe na launcher. Di DLL wey dey di command line na di real program.

rundll32.exe dey to call named export inside DLL. Control Panel applets and some printers still dey use am. Malware like di trusted name well well. Always open di command line.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Malware fit use am?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
I suppose delete am?
No. Windows need di host
Feex tok say
I never dey answer "rundll32 dey safe" from di filename. I dey read di arguments. System32 rundll32 wey dey launch Temp DLL na di real story, no be di host.

Wetin be rundll32.exe?

rundll32.exe na di documented Windows utility wey dey load DLL and call export. Di syntax na rundll32 DLL,EntryPoint.

Wetin e dey do?

E almost no get any work of im own. Display settings, older printer UI, and some Microsoft applets still dey start dis way. Blank command line no common and e make sense to look am.

Wetin make am dey run?

Something call DLL entry point instead of exe. Scheduled tasks and shortcut remnants common well well. Copy wey dey run from SysWOW64 for 32-bit DLL na still Windows.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'rundll32.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

E depend on di DLL

Di host inside System32 dey legitimate. Safety depend on di DLL path and publisher. Filename-only "rundll32 na virus" pages dey skip di only part wey matter.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\rundll32.exe

  • Expected host path: System32 or SysWOW64
  • Read di command line every time
  • rundll32.exe inside user folder no be di Windows host

I fit end am?

E dey stop dat DLL call

To end di process dey close dat applet or payload. If di command line point to temp DLL, na di time be dat to inspect persistence.

I fit comot am?

No for di Windows host

No delete System32\rundll32.exe. Remove di shortcut or task wey dey call bad DLL.

E suppose start with Windows?

Startup shortcut wey dey call rundll32 suppose show full DLL path. Empty name or name wey get number na red flag.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

rundll32.exe file information
Executable name rundll32.exe
Recorded installation path C:\Windows\System32\rundll32.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

rundll32 at every logon

Open di Startup folder and Task Scheduler. Di host no be di autorun. Na di arguments.

People dey delete rundll32 to "stop viruses"

Windows go come fail to start several applets. Di infection na bin di DLL.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Copy di full command line

Task Manager details or Process Explorer. Search dat DLL path, no be di word rundll32.

Confirm di host path

System32 or SysWOW64 only. Any other rundll32.exe na second program.

Technical details

Technical details
rundll32.exe technical details
Image name rundll32.exe
Role DLL entry-point host

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?