cmutil.dll
Microsoft Connection Manager Utility Lib file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real cmutil.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft(R) Connection Manager, Microsoft Corporation
DescriptionMicrosoft Connection Manager Utility Lib
2 known copies
7.2.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmutil.dll · signed by Microsoft Windows
192cc092c2d5a67e26893234285d7c3cd200d3ed6df94f28d19c51b1e7e6d0e77.2.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmutil.dll · signed by Microsoft Windows
e16093f0d634a36c04a5bcebb4faf8ef4703c4059f58e51f4177adebc7dd1584From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names cmutil.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.