davclnt.dll
Web DAV Client DLL file version info
Library on Windows 2 known copies with hashes 3 Sigma rules name it
Is it the real davclnt.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWeb DAV Client DLL
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\davclnt.dll · signed by Microsoft Windows
54d1f31aaa5683f8e4bcf2ccea4be09e772ef5e812da3ddcafc91365cb1dfe8d10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\davclnt.dll · signed by Microsoft Windows
a1d7d9e6a8ef7932d2ef13fee5bd5ab486b2bc5c7abfebc1aab1cddf744dc7bdFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
highSuspicious NTLM Authentication on the Printer Spooler ServiceElastic (idea), Tobias Michalski (Nextron Systems)
highSuspicious WebDav Client Execution Via Rundll32.EXENasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
mediumWebDav Client Execution Via Rundll32.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)