FXSAPI.dll
Microsoft Fax API Support DLL file version info
Library on Windows 3 known copies with hashes 1 Sigma rule names it
Is it the real FXSAPI.dll?
C:\Windows\system32\C:\Windows\system32\DriverStore\FileRepository\prnms002.inf_amd64_026ea33d249e474a\Amd64\C:\Windows\SysWOW64\3 known copies
10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\DriverStore\FileRepository\prnms002.inf_amd64_026ea33d249e474a\Amd64\FXSAPI.DLL · signed by Microsoft Windows
170e4240e66483dffe32beafcb398c2923ea41a52eb17c24462a07538b08f22910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\FXSAPI.dll · signed by Microsoft Windows
d216c6e729d1b234e9be5fe65ee79708e163f728247cc0781c8aa9bbe4f379fe10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\FXSAPI.dll · signed by Microsoft Windows
e2104c3cb5764d02714d75276c44398c9b7dd0773b2597112f5c1536a56710c9From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names FXSAPI.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.