wininet.dll
Internet Extensions for Win32 file version info
Library on Windows 2 known copies with hashes 2 Sigma rules name it
Is it the real wininet.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionInternet Extensions for Win32
2 known copies
11.00.19041.508 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wininet.dll · signed by Microsoft Windows
7d2c19b2d67592e978ecde8a9ae6051c6db30eba9cacef8f5a2b2cd6ec76550a11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wininet.dll · signed by Microsoft Windows
5587ba1202b712484ab4ad61f20fc0f08ec6a7228891ef9353737ea4e85e5ec4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names wininet.dll in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.