umpdc.dll
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real umpdc.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
2 known copies
Version not recorded · C:\Windows\SysWOW64\umpdc.dll · signed by Microsoft Windows
cc79fe5097d294e92efdd67d27e9a0c582ac167423d65cf944ffeed09e19354fVersion not recorded · C:\Windows\system32\umpdc.dll · signed by Microsoft Windows
f9cfe5484b667cf68a027102cff14f5c5fb7ea1b1a0a9e4a1f9fcbb3d5817a43From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names umpdc.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.