wer.dll
Windows Error Reporting DLL file version info
Library on Windows 2 known copies with hashes 2 Sigma rules name it
Is it the real wer.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Error Reporting DLL
2 known copies
10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wer.dll · signed by Microsoft Windows
390d49d1bdac820f6c81f0554fa540ffc488b7bbc96420ae6a73cbbc33c45ff410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wer.dll · signed by Microsoft Windows
9c78371a5db35effc16ac34e217a47a27c280d5c1a6c5e6f7441b133b26adfaaFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names wer.dll in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.