Quickfix AI
rundll32.exeUsually safe

What is rundll32.exe?

Publisher: Microsoft CorporationTypical location: C:\Windows\System32\rundll32.exe

rundll32.exe is a legitimate Windows system file from Microsoft. It is used to launch functions stored in DLL files, which lets Windows and some programs reuse shared components.

What it does

Windows uses rundll32.exe to run specific tasks from DLL files instead of opening a full app. You may see it appear briefly during normal Windows activity, Control Panel actions, printers, sound settings, or other system features. By itself, it is not an app you normally open directly.

Is it safe?

Yes, the real rundll32.exe is safe and part of Windows. However, malware sometimes disguises itself using this exact name. The real file is usually located at C:\Windows\System32\rundll32.exe and should show Microsoft Corporation as the publisher. If it is running from another folder, has no signature, or looks unusual, treat it as suspicious.

Why it causes high CPU or disk usage

  • 1A Windows task or Control Panel component is using it to run a DLL function.
  • 2A buggy or stuck third-party program is calling it repeatedly.
  • 3Malware is impersonating the name and consuming resources.
  • 4Corrupt system files or a failing driver are triggering repeated calls.

How to check if it's legitimate

  1. Open Task Manager, right-click rundll32.exe, and choose Open file location.
  2. Check that the file is in C:\Windows\System32 and not in a random or temporary folder.
  3. Right-click the file, open Properties, and confirm the Digital Signatures or Details show Microsoft Corporation.
  4. If the path or publisher does not match, run a malware scan and look for the parent app that started it.
  5. If it is the real Microsoft file but CPU stays high, restart the PC and check for Windows updates.

How to remove it

Do not delete the real rundll32.exe; it is a core Windows file. If you found a copy running from an unusual location, that copy may be malicious. In that case, run a malware scan, isolate the suspicious file, and remove the offending program or startup entry rather than the Windows system file itself. If you are unsure, keep the file in place and investigate the path, publisher, and the program that launched it.

Need more help?

Run a free diagnostic scan to identify and fix issues automatically.

Download Quickfix AI