windows enabled community high v1.0.0

advpack

Utility for installing software and drivers with rundll32.exe Located at: c:\windows\system32\advpack.dll; c:\windows\syswow64\advpack.dll.

📋 Live Preview
advpack
advpack

Sandbox: execFile · Timeout: 30s

Capabilities

security.defense-evasion.bypass
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). (Run local or remote script(let) code through INF file specification.)

rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied). (Run local or remote script(let) code through INF file specification.)

rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},,1,

Launch a DLL payload by calling the RegisterOCX function. (Load a DLL payload.)

rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}

Launch an executable by calling the RegisterOCX function. (Run an executable payload.)

rundll32.exe advpack.dll,RegisterOCX {PATH:.exe}

Launch command line by calling the RegisterOCX function. (Run an executable payload.)

rundll32 advpack.dll, RegisterOCX {CMD}

Detection

Documentation

advpack

advpack is a Windows LOLBin. Utility for installing software and drivers with rundll32.exe Located at: c:\windows\system32\advpack.dll; c:\windows\syswow64\advpack.dll.

References