To determine the malware's behavior and to monitor its activity using dynamic analysis, it is essential to understand how to execute the DLL. As previously mentioned, a DLL needs a process to run. On Windows, rundll32.exe can be used to launch a DLL and to invoke functions exported from the DLL. The following is a syntax to launch a DLL and to invoke an export function using rundll32.exe:
rundll32.exe <full path to dll>,<export function> <optional arguments>
The parameters associated with rundll32.exe are explained as follows:
- Full path to DLL: Specifies the full path to the DLL, and this path cannot contain spaces or special characters.
- Export function: This is a function in the DLL that will be ...
