Procedure examples

FunnyDream can use `rundll32` for execution of its components.

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.

BoomBox can use RunDLL32 for execution.

DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.

Egregor has used rundll32 during execution.

FELIXROOT uses Rundll32 for executing the dropper program.

ZxShell has used rundll32.exe to execute other DLLs and named pipes.

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.

The Winnti for Windows installer loads a DLL using rundll32.

Troll Stealer is dropped as a DLL file and executed via `rundll32.exe` by its installer.

Heyoka Backdoor can use rundll32.exe to gain execution.

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

Comnie uses Rundll32 to load a malicious DLL.

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.

HermeticWizard has the ability to create a new process using `rundll32`.

PcShare has used `rundll32.exe` for execution.

Koadic can use Rundll32 to execute additional payloads.

Rundll32.exe is used as a way of executing Flame at the command-line.