srpapi.dll
SRP APIs Dll file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real srpapi.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSRP APIs Dll
2 known copies
10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\srpapi.dll · signed by Microsoft Windows
ad4ad65e6da0f4334016bed8eb1c88cf4d0d554e591a85ab87fd6fdea627fb6110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\srpapi.dll · signed by Microsoft Windows
1275db07f797d358f13bd60de7588419a006c609be146c656b8f669a018307dcFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names srpapi.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.