twext.dll
Previous Versions property page file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real twext.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPrevious Versions property page
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\twext.dll · signed by Microsoft Windows
39ffc283af9a08489705c4c4ab5028f4ba0fd4c5fdd0677df9e842cfcf3e2ced10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\twext.dll · signed by Microsoft Windows
4f0066c1d6090771d45d077be3f15422e0bb4d7d5fec8629027d7a2fad3a303cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names twext.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.