CmdID / Files

winsqlite3.dll

SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. file version info

Library on Windows 2 known copies with hashes 1 Sigma rule names it

Is it the real winsqlite3.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductSQLite, SQLite Development Team

DescriptionSQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.

2 known copies

3.29.0 · C:\Windows\system32\winsqlite3.dll · signed by Microsoft Windows

SHA-2563dc5c404d450d1ea27b2a47768addff610f3a4a484042f5c1b107b77a12aeb8dSHA-13f2736dee80a7d18849ec8900af4fba9883aa455MD57939ed538de6a9042137a6fe94185b01

3.29.0 · C:\Windows\SysWOW64\winsqlite3.dll · signed by Microsoft Windows

SHA-2569c94cb1a01f743934920a4f4c96a53402a23ee35f71a35c24f59c90040ea68afSHA-1c74d557292b08da42b897d6bc4f35dd550fa9fcbMD524cfdcc0387c6a45ee6877d2cb80ba5f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.

What detects it

Sigma rules that name winsqlite3.dll

When it is loaded

highPotential System DLL Sideloading From Non System LocationsNasreddine Bencherchali (Nextron Systems)

CmdID evaluates Sigma’s process creation rules against a command line. These watch what a command line does not show: a library or a driver loading, a file written, the registry, another process opened, event logs. They are listed as Sigma has them, at SigmaHQ.