CmdID / Files

Windows.UI.Immersive.dll

WINDOWS.UI.IMMERSIVE file version info

Library on Windows 2 known copies with hashes 1 Sigma rule names it

Is it the real Windows.UI.Immersive.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWINDOWS.UI.IMMERSIVE

2 known copies

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Windows.UI.Immersive.dll · signed by Microsoft Windows

SHA-256f8881ac494dae38e9cd40dbc3196596a9fc8136fe44d2f5f7551d7852d64d025SHA-1f6953b5ba35a2d9380bb2f49a54eed303ca134d4MD5438047b67c0b0c692dfd0e7d745c7ccb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Windows.UI.Immersive.dll · signed by Microsoft Windows

SHA-256df9046e4bd3ec8470b39121357bc093ff37b58da4ec59c457bb12cfca47674d9SHA-1d219a97b5ac025abf463ee2fe040267e22c09e17MD54190ab0704bc66a56bd924f10370f874

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.

What detects it

Sigma rules that name Windows.UI.Immersive.dll

When it is loaded

highPotential System DLL Sideloading From Non System LocationsNasreddine Bencherchali (Nextron Systems)

CmdID evaluates Sigma’s process creation rules against a command line. These watch what a command line does not show: a library or a driver loading, a file written, the registry, another process opened, event logs. They are listed as Sigma has them, at SigmaHQ.