Suspicious Unsigned DLL Loaded by a Trusted Process

sequence by process.entity_id with maxspan=5s
[library where
   (dll.Ext.relative_file_creation_time < 5000 or
    dll.Ext.relative_file_name_modify_time < 5000 or
    (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk","USB *") and not dll.path : "C:\\*")) and
    process.code_signature.trusted == true and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    dll.hash.sha256 != null and 
    not dll.hash.sha256 in ("e99fec7f1f2fe16029b4dbe30a96325efd7265c9cc8672f60945ce943684442d", "a654a64f0fbd2c34fc2b22cb41e2bf4ac32bd15ae6620e6a4198beb5270790f6") and
    (process.thread.Ext.call_stack_summary : "ntdll.dll*" and not process.thread.Ext.call_stack_summary : "*Unbacked*") and
    not dll.path : ("?:\\Windows\\Installer\\*",
                   "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                   "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
                   "?:\\Program Files\\*",
                   "?:\\Program Files (x86)\\*",
                   "?:\\Windows\\assembly\\*") and
   not process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and

   /* DLL loaded from the process.executable current directory */
   endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))]
[library where
  dll.name : ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
  process.thread.Ext.call_stack_summary : "ntdll.dll
| kernelbase.dll
| Unbacked"]