ShInstUtil.exe
ShInstUtil - KeePass Helper Utility file version info
Program on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real ShInstUtil.exe?
C:\Program Files (x86)\KeePass Password Safe 2\2 known copies
2.46.0.0 · C:\Program Files (x86)\KeePass Password Safe 2\ShInstUtil.exe · signed by Open Source Developer
c12bcaa756684b396a7b8a7f25b08e0f31d0649b856156c7f95ac3b6543fd0492.45.0.0 · C:\program files (x86)\KeePass Password Safe 2\ShInstUtil.exe · signed by Open Source Developer
de4b86e51c3933ee1c92001351bd98e96c90058d79464f2afdfcf384bb767624From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names ShInstUtil.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.