msxml3.dll
MSXML 3.0 file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real msxml3.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft XML Core Services, Microsoft Corporation
DescriptionMSXML 3.0
2 known copies
8.110.19041.1 · C:\Windows\SysWOW64\msxml3.dll · signed by Microsoft Windows
d5bfed8022112e9e214502a654a04286677bbc2a599c8a8c5faa119d58ddf3ef8.110.19041.1 · C:\Windows\system32\msxml3.dll · signed by Microsoft Windows
faa37a342013edbd1dc9ad691c488f15d2fd0a3e1b941263b669a0b00cd579a0From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names msxml3.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.