offreg.dll
Offline registry DLL file version info
Library on Windows 3 known copies with hashes 1 Sigma rule names it
Is it the real offreg.dll?
C:\Program Files\Common Files\microsoft shared\ClickToRun\C:\Windows\system32\C:\Windows\SysWOW64\3 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\offreg.dll · signed by Microsoft Windows
a08db8ae56c878b092dc1ca87588b7fa33ab3ad6d3edc5a4cbc781727ff1597210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\offreg.dll · signed by Microsoft Windows
f66d8c74d661a76095276e54b28170268ec9042ce32d8d95fb094d1bd7ac408b10.0.18362.1 (WinBuild.160101.0800) · C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll · signed by Microsoft Corporation
161f36165dc9d2125153a273c607d97aac16d8cec8995e6636dbb668ef3bfb3fFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names offreg.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.