Learning Malware Analysis

2.8.1 Using rundll32.exe to Debug the DLL in x64dbg

Another effective method is to use rundll32.exe to debug the DLL (let's suppose that you want to debug a malware DLL named rasaut.dll). To do so, first load rundll32.exe from the system32 directory (via File | Open) into the debugger, which will pause the debugger at the system breakpoint or the Entry point of rundll32.exe (depending on the settings mentioned earlier). Then, select Debug | Change Command Line and specify the command-line arguments to rundll32.exe (specify the full path to the DLL and the export function), as follows, and click on OK:

Next, select the Breakpoints tab, right-click ...