rundll32.exe

A built-in Windows utility that loads a DLL and calls an entry point explicitly designed for Rundll32. Adversaries abuse it as a trusted-binary proxy for code execution and stealth. The selected DLL determines the operation; Rundll32 does not inherently perform shell execution, memory injection, privilege escalation, or bypass application-control policy, and it runs in the launching process's security context.