Pcwutl.dll

Commands

1. ExecuteUser T1218.011

   Launch an executable.

   rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}

   Launch executable by calling the LaunchApplication function.

   os: Windows 10, Windows 11

   Execute: EXE

Detection

• Analysis https://redcanary.com/threat-detection-report/techniques/rundll32/
• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Resources

• https://twitter.com/harr0ey/status/989617817849876488
• https://windows10dll.nirsoft.net/pcwutl_dll.html