Code Execution via Pcwutl.dll and Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of an executable by calling the 'LaunchApplication' function from the 'pcwutl.dll' library via 'rundll32.exe'. This technique is often used for defense evasion to proxy execution of malicious code.