# rundll32.exe

Windows Process: Microsoft Corporation

Also called rundll32, run a dll as an app

Windows, System Component

Run a DLL as an App. It loads an exported function from a DLL. The command line, not the filename, says what it is doing.

## What you need to know

The exe is a launcher. The DLL on the command line is the real program.

rundll32.exe exists to call a named export in a DLL. Control Panel applets and some printers still use it. Malware loves the trusted name. Always open the command line.

- **Safe?**: Only if the DLL is trusted

  **Can malware use it?**: Yes. Read the command line

  **Should I delete it?**: No. Windows needs the host

Feex says

I never answer "is rundll32 safe" from the filename. I read the arguments. A System32 rundll32 launching a Temp DLL is the story, not the host.

## What is rundll32.exe?

rundll32.exe is the documented Windows utility that loads a DLL and calls an export. The syntax is rundll32 DLL,EntryPoint.

## What does it do?

It has almost no job of its own. Display settings, older printer UI, and some Microsoft applets still start this way. A blank command line is unusual and worth a look.

## Why is it running?

Something invoked a DLL entry point instead of an exe. Scheduled tasks and shortcut remnants are common. A copy running from SysWOW64 for a 32-bit DLL is still Windows.

## Is it safe?

Depends on the DLL

The host in System32 is legitimate. Safety is the DLL path and publisher. Filename-only "rundll32 is a virus" pages skip the only part that matters.

A legitimate copy normally runs from:

`C:\Windows\System32\rundll32.exe`

- Expected host path: System32 or SysWOW64
- Read the command line every time
- A user-folder rundll32.exe is not the Windows host

## Can I end it?

Stops that DLL call

Ending the process closes that applet or payload. If the command line pointed at a temp DLL, that is the moment to inspect persistence.

## Can I remove it?

No for the Windows host

Do not delete System32\rundll32.exe. Remove the shortcut or task that calls a bad DLL.

## Should it start with Windows?

A Startup shortcut that calls rundll32 should show a full DLL path. An empty or numbered name is a red flag.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the DLL

  **Memory**: Follows the DLL

  **Disk**: Follows the DLL

  **Network**: Follows the DLL

## File information

| Executable name        | rundll32.exe                     |
| ---------------------- | -------------------------------- |
| Common legitimate path | C:\Windows\System32\rundll32.exe |
| Publisher              | Microsoft Corporation            |
| Signature expectation  | Signed by Microsoft Windows      |

## Common problems

### rundll32 at every logon

Open the Startup folder and Task Scheduler. The host is not the autorun. The arguments are.

### People delete rundll32 to "stop viruses"

Windows then cannot start several applets. The infection was the DLL.

## Troubleshooting

Diagnose before you change anything destructive.

### Copy the full command line

Task Manager details or Process Explorer. Search that DLL path, not the word rundll32.

### Confirm the host path

System32 or SysWOW64 only. Any other rundll32.exe is a second program.

## Technical details

Technical details

| Image name | rundll32.exe         |
| ---------- | -------------------- |
| Role       | DLL entry-point host |

## Related

These entities connect to this article. Type is shown on every link.

[dllhost.exe: Windows Process](https://feex.it/wiki/process/dllhost.exe)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: rundll32 ](https://learn.microsoft.com/windows-server/administration/windows-commands/rundll32)· Official host usage
- [Microsoft Support: Windows ](https://support.microsoft.com/windows)· Public support naming
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: rundll32.exe

  **Typical path**: C:\Windows\System32\rundll32.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/rundll32.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)