atl.dll
ATL Module for Windows XP (Unicode) file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real atl.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft (R) Visual C++, Microsoft Corporation
DescriptionATL Module for Windows XP (Unicode)
2 known copies
3.05.2284 · C:\Windows\SysWOW64\atl.dll · signed by Microsoft Windows
43eacd6b094275d3cb0e2c12572697048306fd55f7e4d3ebe16c09be671305ba3.05.2284 · C:\Windows\system32\atl.dll · signed by Microsoft Windows
b2125ac5394144f027e056a07854e39a03d6eaa420160fa40e488b5d3175a685From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names atl.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.