File scan report
Verdict Safe
Is Party
No engines flagged this established Microsoft-signed DLL, and the isolated mapping lacks a target or corroborating malicious behavior.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged PartyWin.dll, and its signature verifies to Microsoft Corporation, a curated trusted publisher. One sandbox mapped possible process injection, but named no injected target, returned no malicious outcome, and provided no corroborating network or persistence evidence.
The strongest evidence is the verified Microsoft Corporation signature combined with no detections among 75 engines. The file has also circulated broadly since 2021, with 622 submitters and 985 submissions, reducing concern that it is a newly introduced impersonation. Five recent signer-matched files received consistent benign assessments, and Microsoft signer history is 28 of 29 in that direction. A sandbox mapped T1055, but no injected target was recorded and the run did not produce a malicious outcome. Ten dropped files remain unresolved, and no complete host-reputation cross-check is available, but those coverage limits do not outweigh the strong identity, prevalence, and detection evidence.
What We Detected
None of the 71 antivirus engines that checked it flagged the DLL, including all 17 major contributors. Its digital signature verifies to Microsoft Corporation and matches a curated trusted publisher, while historical signer data records 28 of 29 assessed samples as benign. The file has been observed since 2021 across 622 submitters and 985 submissions.
Threat Behavior
One completed sandbox run mapped T1055, which can indicate process injection. However, it recorded no injected target, no malicious sandbox outcome, no persistence indicators, and no sample network contacts. The ten dropped files have no saved assessments, so their status remains unresolved; no complete contacted-host reputation result is available.
What To Do Now
Use the file only when it came from Microsoft, Windows, or another trusted software package, and retain security software. If its origin is unexpected, verify the digital signature and hash before loading the DLL.
Where this verdict could be wrong3 caveats
- One sandbox mapped possible process injection under T1055, although it identified neither an injected process nor a malicious sandbox outcome.
- Ten dropped files have no saved assessments, leaving their status unresolved rather than established as benign.
- No complete contacted-host reputation result is available, although the observed sandbox run recorded no sample network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No antivirus engine among 75 flagged the file.
- The digital signature verifies to Microsoft Corporation, a curated trusted publisher.
- The Microsoft signer history contains 28 benign assessments out of 29 samples.
- The file is established, with 622 submitters and 985 submissions since 2021.
- Five recent signer-matched files received consistent benign assessments.
- One sandbox mapped possible process injection behavior, but did not identify a target process.
- A complete reputation check for contacted hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 1spawned processes
- 0network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1016· Network recon
- T1018
- T1027· Obfuscated code
- T1027.005· Obfuscated code
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1614
Observed activity
Processes started
1Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
Files
30Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\c8374023-2242-4c2d-b570-094d81e16543 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\72d66b80-5567-4495-a722-ef29a2932662 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\fc9f190c-3f76-4cce-9262-02c3797017c4
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2e46a34a-f7e7-4dab-9e1f-f5f0dc4d1cff - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\2ad6985e-96a1-4cf8-9e89-cb965f2adf61 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\4208ef58-e6bf-4eb3-b2e5-442d52c22d5a - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER428D.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER47CE.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4917.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Par_3fc5588aa8b96e1b8b5cf4dc861ebdc96591a6e1_a4c011f7_1c7ba774 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Par_3fc5588aa8b96e1b8b5cf4dc861ebdc96591a6e1_a4c011f7_1c7ba774\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Par_3fd5eec57444e396a86c49901274b8f39231_a4c011f7_1cf8287b - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER428D.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER47CE.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4917.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER428D.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER47CE.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4917.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_02eea1aa - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_02eea1aa\Report.wer - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1265f538 - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1265f538\Report.wer - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1c574b4d - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1c574b4d\Report.wer - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER81EA.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER81EA.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER82A6.tmp
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\WritePermissionsCheck - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name
Show all 15 entries for registry and auto-start
- Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate - Set
\REGISTRY\A\{3af8ecff-4024-57e8-46d4-dea556c56fb6}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess3016Global\AmiProviderMutex_InventoryApplicationFileGlobal\3ef614a4-8b86-48c8-9e40-418d461b252a\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess772\Sessions\1\BaseNamedObjects\Global\ea1219cd-87c1-4e83-a059-8f381a95bd95\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2908
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\a25aa63d-a3c7-42a5-b4aa-2289c576717d\Sessions\1\BaseNamedObjects\Global\34a0b669-b738-4c1e-af50-b9a8b5d28660\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5828\Sessions\1\BaseNamedObjects\Global\7eb9cbaa-2731-4577-b0de-691f7b1b1944
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3016 -s 560
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 87505c79ffc9cf79f563…fda75cNot checkedno saved verdict
- 28b01c35b40cfb742fba…714994Not checkedno saved verdict
- 1ac34cd3d7765fdd6dd3…108f1aNot checkedno saved verdict
- b108cb8728b47e532278…f67092Not checkedno saved verdict
- 1531ffb8931aec46c29c…27b46cNot checkedno saved verdict
- 2d00bf8c227252464058…80e5cbNot checkedno saved verdict
- cce8b4c7e9988aa2b7f8…862a99Not checkedno saved verdict
- ba50e9dd7bad03d7c92a…02b05dNot checkedno saved verdict
- a690d5d0ecbe63e99abc…0abe72Not checkedno saved verdict
- 521bf66a3658822c7a74…fc0d60Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 9, 2026, 10:22 PM UTC
- SHA-256
0cc1bf6419ae53379fd8b84dcfd12ced0616f351f77dc1dd30566f7ba24b2f46- SHA-1
755af4a4b1f277a88221de2d03702b762881c6ac- MD5
0d1ee9c559a61023257d3f4cbdc4928d
About this file
PartyWin.dll is a Win32 DLL file of 2.9 MB.
- Type and size
- Win32 DLL · 2.9 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Mar 10, 2021On VirusTotal.
- Submitted by
- 622 distinct sources
- Packer
- None detected
- Entropy
- 6.25 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is PartyWin.dll safe?
What is PartyWin.dll?
How many antivirus engines detected PartyWin.dll?
Is PartyWin.dll digitally signed?
What is the SHA-256 hash of PartyWin.dll?
Is it safe to use PartyWin.dll?
How up to date is this analysis of PartyWin.dll?
Community
Member reviews and reports for this exact file hash.