File scan report

Verdict Safe

Analyzed Oct 24, 20261 day ago

Is lua54.dll safe? Yes, no threats found.

None of the 70 antivirus engines that checked it flagged this 64-bit Lua DLL, it has been submitted by 331 sources since 2021, and its sandbox runs were clean.

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Use it as usual if it came from the official source

No action is needed. Download libraries from their official project source and keep your antivirus enabled.

Good practice2 tips

We found nothing harmful in this file.

Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

0 of 70 flagged

Flagged 0
No detection 70
No result 5

Filelua54.dll356.2 kBSHA-256 0fe22c4f4446…f20955

Code signing Unsigned
Test run Completed
First seen 5y ago

It has a long history: seen by 331 sources over more than six months.

Chapter 02

Why we think so

1 point against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

It has been seen from 331 distinct submitters since first seen on Jan 16, 2021. No hostile network contacts or injection targets were recorded.

Where this verdict could be wrong1 caveat

The DLL is unsigned, so there is no publisher identity to confirm the build is the genuine Lua library.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 4 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

4isolated sandbox runs
13sandbox rule tags
1spawned processes
0network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 4 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

1

VT: CLEANclean

Techniques observed in the sandbox

13

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1018
T1027· Obfuscated code
T1027.002· Obfuscated code
T1055· Process injection
T1057· Lists programs
T1071· Application protocol
T1082· System recon
T1095· Custom network
T1129· Loads modules
T1218.011
T1497· Sandbox evasion
T1518.001· Checks your AV

Observed activity

Processes started

1

Programs the file ran, with their command lines.

rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1

Files

30

Files the file created, changed or deleted.

WrittenC:\ProgramData\Microsoft\Windows\WER\Temp
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\112c75da-be6d-43a7-988a-2ae53558cf91
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportQueue
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\6f4fc23e-b684-4133-bd11-365924de7d41
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\7464b618-8136-4c4b-ab48-f3080a35d506

Show all 30 entries

WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\13886ec0-7fbc-4b60-abf5-985b66dc88de
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\2e94676a-f2a0-4246-986f-b1ed49eb0891
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportQueue\fca8f295-cf6a-4bd8-989e-309617034d44
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\WER4E74.tmp.dmp
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\WER53C4.tmp.WERInternalMetadata.xml
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\WER55AA.tmp.xml
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lua_30dc1112d22a8a3915c96d75a8eb934e41c8dc6_c2285d6f_04cbd170
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lua_30dc1112d22a8a3915c96d75a8eb934e41c8dc6_c2285d6f_04cbd170\Report.wer
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_lua_30dc1112d22a8a3915c96d75a8eb934e41c8dc6_c2285d6f_0c9be2f5
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER4E74.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER53C4.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER55AA.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER4E74.tmp.dmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER53C4.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER55AA.tmp.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_15d6973b
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_15d6973b\Report.wer
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_172deaf8
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_172deaf8\Report.wer
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_174f43cc
DeletedC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_174f43cc\Report.wer
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E01.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E01.tmp.dmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER8313.tmp

Registry and auto-start

15

Settings the file changed, including ways to start again after a restart.

Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\WritePermissionsCheck
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name

Show all 15 entries

Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate
Set\REGISTRY\A\{57e58bab-7551-749f-7579-2204c5988604}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion

Mutexes

10

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\WERReportingForProcess3220
Global\AmiProviderMutex_InventoryApplicationFile
Global\8c0575a4-80f6-4bcd-bbb7-c01dfa5c1cf7
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6444
\Sessions\1\BaseNamedObjects\Global\f03d8800-8cd6-4172-bea0-0c00617cfd1a
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6424

Show all 10 entries

\Sessions\1\BaseNamedObjects\Global\9225c918-90ef-48c5-822c-b41ee16afd2b
\Sessions\1\BaseNamedObjects\Global\daf7b180-5425-4ae0-8538-082d7907dfe9
\Sessions\1\BaseNamedObjects\Global\78b451ea-45e3-4337-86ae-b3c14f0f4214
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4332

Sandbox background — not the file

7

The analysis machine's own processes and connections, recorded in every run.

VM processWerFault.exeC:\Windows\system32\WerFault.exe -u -p 3220 -s 540
VM host245.50.188.52.in-addr.arpa
VM hostfp2E7A.wpc.2BE4.phicdn.net
VM host49.28.101.95.in-addr.arpa
VM hostfp2e7a.wpc.phicdn.net
VM host154.210.82.20.in-addr.arpa

Show all 7 entries

VM host61.234.212.23.in-addr.arpa

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

2114966cd92f2c0756c3…7e81c0Not checked
no saved verdict
c2d20b876309b5a7a164…2f35acNot checked
no saved verdict
511bec6a461faf1df5f9…feb402Not checked
no saved verdict
4a0b72c15aa79e7612a1…a9cb0bNot checked
no saved verdict
35622f12eec93df19720…bfddc5Not checked
no saved verdict
6e7f007a7c20bd92f08a…1fd399Not checked
no saved verdict
29378d9649e121f8b9f0…892389Not checked
no saved verdict
98f0297bf122de985753…c97518Not checked
no saved verdict
65bffd02710701f7633e…aac556Not checked
no saved verdict
6a18b1dbfb89e168609d…5b8d8bNot checked
no saved verdict

Chapter 04

Technical details

None of the 70 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 70 engines flagged it · 5 gave no result DetailsJun 29, 2026

Sandbox runVirusTotal sandboxes · C2AE, CAPA, CAPE SandboxComplete4 runs: 1 clean, 3 without a verdict DetailsOct 24, 2026

Contacted hostsMalwareTips URL scannerComplete6 contacted hosts checkedOct 24, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 24, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 24, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 24, 2026

File fingerprint

Last analyzed: Oct 24, 2026, 9:19 PM UTC

SHA-256: 0fe22c4f44465370bc44dcf47370052edf19a006b1ccc3f36a19ee30eff20955
SHA-1: 95da0c62c06417cc1e699e8a9861079aaa83f669
MD5: 381cb8b617adb5c253a4f7a1dc368f47

About this file

lua54.dll is a Win32 DLL file of 356.2 kB.

Type and size: Win32 DLL · 356.2 kB
Signer: UnsignedNo code signature.
First seen: Jan 16, 2021On VirusTotal.
Submitted by: 331 distinct sources
Packer: None detected
Entropy: 5.96 of 8

First scanned Oct 24, 2026

Antivirus consensus

0 of 70 engines flagged this file

0 malicious0 suspicious70 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-117 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusNo result
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 5.96Unpacked

Section entropy16 sections

.text

6.30

.data

1.42

.rdata

5.46

.pdata

5.36

.xdata

4.21

.bss

0.00

.edata

4.96

.idata

4.23

.CRT

0.21

.tls

0.26

.rsrc

3.00

.reloc

4.77

/4

0.24

/19

5.88

/31

3.04

/45

3.23

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

331

Hundreds of people have uploaded this — common.

Total submissions

365

Includes repeat uploads by the same source.

First seen

6y ago

Jan 16, 2021

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is lua54.dll safe?

We found nothing harmful in lua54.dll. None of the 70 antivirus engines that checked it flag it. Use it only as part of a program you got from the developer's own website.

What is lua54.dll?

lua54.dll is a Windows library (DLL), about 356.2 kB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jan 16, 2021.

How many antivirus engines detected lua54.dll?

None of the 70 antivirus engines that checked it flag lua54.dll. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of lua54.dll?

The SHA-256 fingerprint of lua54.dll is 0fe22c4f44465370bc44dcf47370052edf19a006b1ccc3f36a19ee30eff20955, and its MD5 is 381cb8b617adb5c253a4f7a1dc368f47. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to use lua54.dll?

We found nothing harmful in lua54.dll. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of lua54.dll?

This report reflects the scan on Oct 24, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is lua54.dll safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is lua54.dll safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports