whhelper.dll
Net shell helper DLL for winHttp file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real whhelper.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNet shell helper DLL for winHttp
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\whhelper.dll · signed by Microsoft Windows
083bee2b3d75fc8e6418fad2d375fb57a9118ac3bfe87dd854fc7c3f252d1d8910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\whhelper.dll · signed by Microsoft Windows
1b282ee4faaa90f274676421d69f8d6388dbd957aef39a8b57f2aed98a2f44caFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names whhelper.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.