Pcwutl.dll — LOLBAS

Execute

ExecutionWindows

Launch executable by calling the LaunchApplication function.

Use Launch an executable.

rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218.011
Detection: Analysis: redcanary.com/threat-detection-report/techniques/rundll32/
Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
Refs: twitter.com/harr0ey/status/989617817849876488
windows10dll.nirsoft.net/pcwutl_dll.html
lolbas-project.github.io/lolbas/Libraries/Pcwutl/