2.8.1 Using rundll32.exe to Debug the DLL in x64dbg

Another effective method is to use rundll32.exe to debug the DLL (let's suppose that you want to debug a malware DLL named rasaut.dll). To do so, first load rundll32.exe from the system32 directory (via File | Openinto the debugger, which will pause the debugger at the system breakpoint or the Entry point of rundll32.exe (depending on the settings mentioned earlier). Then, select Debug | Change Command Line and specify the command-line arguments to rundll32.exe (specify the full path to the DLL and the export function), as follows, and click on OK:

Next, select the Breakpoints tab, right-click ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.