Back to Techniques

rundll32.exe

rundll32.exe is a Windows utility that loads and runs DLL files. It's commonly used to execute functions exported from DLL files. Attackers frequently abuse this legitimate Windows binary to execute malicious code, bypass application whitelisting, and load malicious DLLs.

windows cli MOTW UAC

Fix Windows Font Display

MOTW

Your system fonts are not displaying correctly. Apply this fix to restore proper font rendering:

Press Win-R on your keyboard
Type rundll32 and press Enter
Press Ctrl-V to paste the font configuration
Press Enter to execute

References:

https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Mitigations:

Monitor for suspicious rundll32.exe command lines
Implement application control to restrict rundll32.exe execution patterns
Never run commands from untrusted sources
Be suspicious of requests to fix display or font issues via command line

Contributor: Michael Haag (2025-09-09)

Update Audio Drivers

UAC

Your audio drivers need to be updated. Follow these steps to install the latest drivers:

Press Win on your keyboard
Type rundll32 and press Ctrl+Shift+Enter
Click Yes when prompted
Press Ctrl-V to paste the driver update command
Press Enter to execute

References:

https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Mitigations:

Monitor for suspicious rundll32.exe command lines
Implement application control to restrict rundll32.exe execution patterns
Never run commands from untrusted sources
Always update drivers through official manufacturer websites or Windows Update

Contributor: Michael Haag (2025-09-09)