What Is the Rundll32.exe Process and What Does It Do?

Learn about this Windows task manager process

Rundll32.exe is an application that allows Dynamic Link Library (DLL) files to be executed by other applications. Without the rundll32.exe process, applications wouldn't be able to load the library code and run properly. As a regular user of the computer, you don't interact with Rundll32.exe directly.

Rundll32.exe and DLL Files

Almost all applications need to make use of various Windows dynamic link library files. These library files allow applications to call Windows specific functions for different Windows system functions.

  • Displaying windows and other objects for a graphical user interface.
  • Playing sounds using the computer's audio driver and hardware.
  • Transferring inputs and outputs from hardware like the keyboard and mouse
  • Storing information in system memory.
  • Accessing any accessories connected to your computer.

There are multiple DLL files located throughout the Windows operating system, but none of those libraries can be accessed without going through Rundll32.exe. The process serves as a gateway for all applications to access those libraries.

How Rundll32.exe Works

Applications call Rundll32.exe each time that application needs to access a Windows library function.

The following is how that process works.

  1. Programmers specify Rundll32.exe when writing an application. For example, to access speech recognition libraries when writing an application in Visual Basic, the programmer will write a line like shown below.

    Process.Start("rundll32.exe", "C:\Windows\system32\speech\speechux\SpeechUX.dll, RunWizard UserTraining")
  2. This command calls the Rundll32.exe application and tells it to provide the application with access to the RunWizard UserTraining components found inside the SpeechUX.dll library stored in the System32 directory.

  3. The programmer can then call specific functions found within those components. For example, these may include speech recognition training using the microphone. Without the Rundll32.exe executable, applications wouldn't have access to those advanced functions.

Every time an application launches Rundll32.exe, you'll see a new instance of that process show up in Task Manager. Each instance has four main parameters that help the application and the operating system keep track of the process.

  • hwnd: The handle (identification ID) of the window your DLL creates
  • hinst: The handle of the process instance launched by your DLL call
  • lpszCmdLine: Command line used to launch the DLL library
  • nCmdShow: Describes how the DLL window should be displayed if there's an associated window

If you see multiple "Rundll32.exe" processes in Task Explorer, this is normal. A new Rundll32.exe process gets launched every time another application calls it.

Common Rundll32.exe Errors

The most common error related to Rundll32.exe is a Runtime Error. This usually occurs when poorly written application code closes the application without properly terminating the Rundll32.exe instances that it previously launched.

This error won't cause any problems with your computer. However, once you reboot the computer, it will kill all launched Rundll32.exe threads and clear the memory used by them.

However, malware sometimes causes Rundll32.exe errors in a couple of ways.

  • Malware installs virus files that are named the same as Rundll32.exe. You won't recognize the virus file when you see it, but antivirus software will recognize it and clean the file from your system.
  • Malware may corrupt the Rundll32.exe application, modifying the file so that it no longer works properly when applications attempt to call it.

In either of these cases, there are a couple of things you should do to clean an infection that corrupted your systems Rundll32.exe file.

  1. Use the Scannow command to identify corrupt core Windows files. Select the Start button and type CMD. Right-click the Command Prompt app and select Run as administrator.

    Screenshot of running command prompt as administrator
  2. Type the command SFC /scannow. This will launch a system scan that'll search out and identify any corrupt system files.

    Screenshot of running the scannow command
  3. If the Rundll32.exe error isn't resolved after this scan, next try to run a DISM restore health command. This utility checks the health of your Windows OS and will attempt to restore any corrupt core system files. Still in the administrative command prompt window, type DISM /Online /Cleanup-Image /RestoreHealth.

    Screenshot of running the DISM RestoreHealth command
  4. If neither of these commands stop the Rundll32.exe error, that means the issue isn't likely a corrupt Windows system file. Instead, it may be a malware application that has camouflaged itself as a file with an identical name or a similar name as Rundll32.exe. The best way to clean these infected files is to run a full system scan with your antivirus software.

    Running antivirus scan on Windows 10 PC
  5. If the issue isn't resolved by this point, your only option may be to restore your Windows OS installation.