xmllite.dll
Microsoft XmlLite Library file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real xmllite.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft XmlLite Library
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xmllite.dll · signed by Microsoft Windows
51daeedca5266a0732a2a726b9cc17a51dfd98baa1c6c4aa345c9b84fb58eb4410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\xmllite.dll · signed by Microsoft Windows
72d75e550d5b9ce12afbfc78b22fb7a36f1dfb081be51017c85d59cfe386ca4aFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names xmllite.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.