TextShaping.dll
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real TextShaping.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
2 known copies
Version not recorded · C:\Windows\system32\TextShaping.dll · signed by Microsoft Windows
2c5171c2b1c967bc57ff47f46f9f6fc22530d76859c2c249cc9e37ebe17309cbVersion not recorded · C:\Windows\SysWOW64\TextShaping.dll · signed by Microsoft Windows
702c7558787f0a4be0f9c10e8f67eb7ea3c02fa95eb7e826fd6beff39ba039a6From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names TextShaping.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.