cmlua.dll
Connection Manager Admin API Helper file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real cmlua.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft(R) Connection Manager, Microsoft Corporation
DescriptionConnection Manager Admin API Helper
2 known copies
7.2.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmlua.dll · signed by Microsoft Windows
84d354b08008323dadce6a62746db4d08ed09670a2a69636e452eeb87c0c82897.2.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmlua.dll · signed by Microsoft Windows
d00d1c5fe0268b650abb16f3d66b469c049066e8c0508df64801749d09f312a4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names cmlua.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.