StateRepository.Core.dll
StateRepository Core file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real StateRepository.Core.dll?
C:\Windows\system32\C:\Windows\SysWOW64\2 known copies
10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\SysWOW64\StateRepository.Core.dll · signed by Microsoft Windows
0ac52c5ebb026bfe949072261173bd18c4c53180e5d12afbd50e116e9f0597ca10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\StateRepository.Core.dll · signed by Microsoft Windows
716463f9af4c38e1bebe4b3a2cd6e96e84b44d88a86d4ce4066b3d34b6f35a9dFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names StateRepository.Core.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.