LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Pcwutl.dll

View source

Microsoft HTML Viewer

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218.011

Launch executable by calling the LaunchApplication function.

COMMAND
rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}
USE CASE
Launch an executable.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

c:\windows\system32\pcwutl.dll
c:\windows\syswow64\pcwutl.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt harr0ey@harr0ey