Why the RunDLL32.exe executable runs on Windows PC

by Alice Woods - -

Some users have reported about the rundll32.exe process. As you probably already know, Windows operating system includes a number of dynamic link libraries or DLLs. DDLs provide other application with functionalities. For instance, by applying these DDL files, other applications are smaller, take less space, and app developers do not have to code same stuff all over again, instead they refer to the particular DLL. So, when a user clicks ‘Save as’, almost all applications present the same dialogue box.[1]

RunDDL Windows PC resolve

Users are unable to directly open a DLL file[2] on a system. The rundll32.exe process is applied in order to access the functionality stored in DLL files for other programs. The rundll32.exe executable is usually authentic and genuine Windows process which is located in ‘/Windows/System32’. So check the executable’s location and keep in mind, if it is located somewhere else, you are possibly dealing with a malware. In addition run a security scan, to confirm if the system is compromised or infected. 

Which app is using the rundll32.exe executable?

In order to find out which application is using the mentioned executable, users can use Task Manager. However, this time we another Microsoft software will be used names ‘Process Explorer Utility’. Users can download it from its official website and install it on their computers. 

The following steps will provide the information, how to find out which app is executing rundll32.exe.[3]

  1. When the installation of The Process Explorer Utility is completed, simply click on File and choose Show Details for All Processes.  By doing this, you will be able to see all the ongoing processes on your computer. 
  2. Find the rundll32.exe process in the rundll.exe category. It will appear a tooltip with the information about the location of the rundll32.exe executable. It should appear that the target of the DLL is NVIDIA. 
  3. Further, right-click on the process and select Properties and navigate to the image tab. There will appear the full pathname which is being opened. Then see the parent process in order to see which program opened the executable. 

Is the rundll32.exe executable causing any security threats?

Even though often there is only one case of the rundll32.exe executable running on the system, it is also possible to appear more applications that need DLL services. Users always have to make sure that rundll32.exe is at a correct location, otherwise, there is a possibility that the system is infected. 

If you want, you can also disable the program which applies the executable by disabling using Services or simply uninstalling the particular app. 

About the author

Alice Woods
Alice Woods - Antivirus software analyst

Alice Woods is an anti-malware analyst at Reviewedbypro.com. She is passionate about testing new pieces of software and discovering pros and cons of each program.

Contact Alice Woods
About the company Esolutions


now online
Like us on Facebook