mfdetours.dll

Media Foundation Detours Tracing DLL file version info

Library on Windows 4 known copies with hashes 2 Sigma rules name it

Is it the real mfdetours.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMedia Foundation Detours Tracing DLL, Microsoft

DescriptionMedia Foundation Detours Tracing DLL

4 known copies

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\mfdetours.dll · signed by Microsoft Corporation

2baf4227811971ed530356162cfe7f5b041f34ec5f61808949dab19eee420951

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\mfdetours.dll · signed by Microsoft Windows Kits Publisher

5502b1f590310f8c988540760ccf31e90f43b6a7b66bcdab02c2434e49689cb0

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mfdetours.dll · signed by Microsoft Corporation

584ec8a9b682aecd68860dc5bc082a260c9e6cd969a56816596f6ce2ff33592e

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\mfdetours.dll · signed by Microsoft Windows Kits Publisher

acd72b85e8ed269f296056978d09271c878695579b4919101aca34a0947414d4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names mfdetours.dll in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.