Learning Malware Analysis

6.3 Analyzing a DLL with Process Checks

Most of the time, launching a DLL with rundll32.exe will work fine, but some DLLs check if they are running under a particular process (such as explorer.exe or iexplore.exe) and might change their behavior or terminate themselves if they are running under any other process (including rundll32.exe). In such cases, you will have to inject the DLL into the specific process to trigger the behavior.

A tool such as RemoteDLL (http://securityxploded.com/remotedll.php) allows you to inject a DLL into any running process on the system. It allows you to inject a DLL using three different methods; this is useful because if one method fails, you can try another method.

The DLL (tdl.dll) used in the following example, ...