The Windows Process Journey ??? rundll32.exe (Windows Host Process)

“rundll32.exe” is an executable aka the “Windows Host Process” (based on the description field of the PE file), which is located at “%windir%\System32\rundll32.exe”. On a 64 bit-system the file still has the same name (including the number 32) and a 32-bit version is located at “%windir%\SysWOW64\rundll32.exe”.

Overall, the goal of “rundll32.exe” is to load a DLLs (Dynamic Link Libraries) and run a functionality stored in those files (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32). The DLLs are loaded using “LoadLibraryExW” (https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code). “rundll32.exe” is digitally signed by Microsoft and shipped by default with the operating system. By the way, there are also places that say “rundll32.exe” means “Run a DLL as an App” (https://www.file.net/process/rundll32.exe.html).

The way is which we can call a function from a “*.dll” file is by passing the name of the file and the name of the function.

Read More