Skip to content

rundll32.exe

Windows ProcessMicrosoft Corporation

Also called rundll32, run a dll as an app

WindowsSystem Component

Run a DLL as an App. It loads an exported function from a DLL. The command line, not the filename, says what it is doing.

What you need to know

The exe is a launcher. The DLL on the command line is the real program.

rundll32.exe exists to call a named export in a DLL. Control Panel applets and some printers still use it. Malware loves the trusted name. Always open the command line.

Safe?
Only if the DLL is trusted
Can malware use it?
Yes. Read the command line
Should I delete it?
No. Windows needs the host
Feex says
I never answer "is rundll32 safe" from the filename. I read the arguments. A System32 rundll32 launching a Temp DLL is the story, not the host.

What is rundll32.exe?

rundll32.exe is the documented Windows utility that loads a DLL and calls an export. The syntax is rundll32 DLL,EntryPoint.

What does it do?

It has almost no job of its own. Display settings, older printer UI, and some Microsoft applets still start this way. A blank command line is unusual and worth a look.

Why is it running?

Something invoked a DLL entry point instead of an exe. Scheduled tasks and shortcut remnants are common. A copy running from SysWOW64 for a 32-bit DLL is still Windows.

Is it safe?

Depends on the DLL

The host in System32 is legitimate. Safety is the DLL path and publisher. Filename-only "rundll32 is a virus" pages skip the only part that matters.

A legitimate copy normally runs from:

C:\Windows\System32\rundll32.exe

  • Expected host path: System32 or SysWOW64
  • Read the command line every time
  • A user-folder rundll32.exe is not the Windows host

Can I end it?

Stops that DLL call

Ending the process closes that applet or payload. If the command line pointed at a temp DLL, that is the moment to inspect persistence.

Can I remove it?

No for the Windows host

Do not delete System32\rundll32.exe. Remove the shortcut or task that calls a bad DLL.

Should it start with Windows?

A Startup shortcut that calls rundll32 should show a full DLL path. An empty or numbered name is a red flag.

Normal resource behavior

These are contextual labels, not universal averages.

CPU
Follows the DLL
Memory
Follows the DLL
Disk
Follows the DLL
Network
Follows the DLL

File information

rundll32.exe file information
Executable name rundll32.exe
Common legitimate path C:\Windows\System32\rundll32.exe
Publisher Microsoft Corporation
Signature expectation Signed by Microsoft Windows

Common problems

rundll32 at every logon

Open the Startup folder and Task Scheduler. The host is not the autorun. The arguments are.

People delete rundll32 to "stop viruses"

Windows then cannot start several applets. The infection was the DLL.

Troubleshooting

Diagnose before you change anything destructive.

Copy the full command line

Task Manager details or Process Explorer. Search that DLL path, not the word rundll32.

Confirm the host path

System32 or SysWOW64 only. Any other rundll32.exe is a second program.

Technical details

Technical details
rundll32.exe technical details
Image name rundll32.exe
Role DLL entry-point host

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Was this article useful?