opcservices.dll

Native Code OPC Services Library file version info

Library on Windows 5 known copies with hashes 1 Sigma rule names it

Is it the real opcservices.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\App Certification Kit\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\

Signed byMicrosoft Corporation

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNative Code OPC Services Library

5 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\opcservices.dll · signed by Microsoft Corporation

31557ebd562aef05d76714560827fb2844ac186708fecae5b4cd36ff34a530ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\opcservices.dll · signed by Microsoft Corporation

3522072cf40c09b3993452961f7648e26f101748bdde83b53b016f14c30995aa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\OpcServices.dll · signed by Microsoft Windows

3a5ac9bec5c021f2841bbd3e5dbef77c5fde3cae2c69328ebaae1d9e0970bcdd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\OpcServices.dll · signed by Microsoft Windows

70ba262e8a4961b7118166df45bd5c69a69055e23a1b2b47bc1f4b8fb659dd91

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\opcservices.dll · signed by Microsoft Corporation

8feeca004a28c3758336e4879c85f5c4210c77ac881af8783a051e7a59f3d016

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names opcservices.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.