d3d10warp.dll
Direct3D Rasterizer file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real d3d10warp.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDirect3D Rasterizer
2 known copies
10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\system32\d3d10warp.dll · signed by Microsoft Windows
0bc1493fc7acc4de510e6cd0f253afa49a1de04e51f5f160e835f44a8cd1036a10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\d3d10warp.dll · signed by Microsoft Windows
7b6209382939bba7d5dc491abbc81f161fcae8a62340497ab83e8c9aab38bffeFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names d3d10warp.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.