File scan report
Verdict Safe
Is version.
Only 2 of the 62 antivirus engines that checked it flagged this widely submitted DLL, while higher-confidence engines and the combined sandbox assessment provided no…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
No removal is indicated by the available evidence. Keep protection enabled and verify that the DLL came with the expected application if its source is uncertain.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 62 flagged
- Flagged 2
- No detection 60
- No result 13
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic detections are most consistent with false positives: no higher-confidence engine identified malware, and no family was named. The DLL has circulated since Nov 13, 2022 across 292 submitters, while sandbox observations showed no substantiated injection, malicious network activity, or other high-risk technique.
Only 2 of the 62 antivirus engines that checked it flagged the DLL, and both detections came from less reliable engines using generic labels. Fifteen higher-confidence engines reported no detection, and no engine consensus identified a malware family. The combined sandbox verdict was clean, with no named injection target or other corroborated high-risk technique. The and mappings lacked the artefacts they describe and therefore do not establish injection or security tampering. Broad, long-standing prevalence across 292 submitters further supports the conclusion that the two alerts are false positives. The absence of a verified signature limits provenance assurance but does not outweigh the consistent benign evidence.
What We Detected
APEX and Cynet were the only 2 of the 62 antivirus engines that checked it to flag the DLL, and both returned generic alerts rather than a named malware family. Higher-confidence engines did not corroborate those results. The file has been submitted by 292 distinct sources and was first seen on Nov 13, 2022, providing a substantial history inconsistent with an isolated emerging threat.
Threat Behavior
The combined sandbox verdict was clean. No named process-injection target, persistence indicator, malicious host, malware-specific community rule, or known malicious child was identified. T1055 and T1562.001 were unsubstantiated technique mappings without the underlying artefacts, so they do not demonstrate process injection or defence tampering. The two observed domain contacts were identified as analysis-environment background traffic rather than activity from the DLL.
What To Do Now
The evidence supports treating the two generic alerts as false positives. Keep security software enabled and obtain the DLL from its expected software package or official distribution channel if provenance remains important.
Where this verdict could be wrong2 caveats
- APEX and Cynet flagged the file, although neither supplied a malware-family name and no higher-confidence engine corroborated them.
- The DLL is unsigned, so there is no verified publisher identity supporting its provenance.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 2 of the 62 antivirus engines that checked it flagged the file, with no higher-confidence detections.
- The file has been submitted by 292 distinct sources and was first seen on Nov 13, 2022.
- The combined sandbox verdict was clean and recorded no substantiated high-risk technique.
- No malicious host, malware-specific rule, public malware-database entry, or malicious child corroborated the alerts.
- The antivirus analysis found no packing or unusually high-entropy code.
- The DLL is unsigned, so its publisher cannot be verified.
- APEX and Cynet produced generic malicious alerts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 18sandbox rule tags
- 15spawned processes
- 0network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1018
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1542.003
- T1562.001· Disables security
- T1574· Execution hijack
- T1614
Observed activity
Processes started
15Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1loaddll32.exeC:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\init.dll"cmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\init.dll",#1rundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",#1rundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,GetFileVersionInfoArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,GetFileVersionInfoByHandle
Show all 15 entries for processes started
rundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\init.dll,GetFileVersionInfoExArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",GetFileVersionInfoArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",GetFileVersionInfoByHandlerundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",GetFileVersionInfoExArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",VerQueryValueWrundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",VerQueryValueArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",VerLanguageNameWrundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",VerLanguageNameArundll32.exeC:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\init.dll",VerInstallFileW
Files
30Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\4690f554-5239-4fc5-9e90-cf5193a71fe8 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\5f1d62ef-3083-4379-aac9-2d9e876d66f1 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\c1e19421-26b8-4525-8ad2-bcfdd4444c28
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\efd7c324-bc3d-4e2b-b9dd-30f03ca4574f - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\7b1b40e8-03a0-4221-80bb-114924896c63 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\d8a87e50-d800-4b82-ae25-058452a138b6 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8AF.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB30.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCF6.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fe88552d115aaedb4fe1e7a7f21e368bc80ea75_82810a17_0150dd60 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fe88552d115aaedb4fe1e7a7f21e368bc80ea75_82810a17_0150dd60\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fe88552d115aaedb4fe1e7a7f21e368bc80ea75_82810a17_0e34e540 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8AF.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB30.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCF6.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8AF.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB30.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCF6.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_02eea1aa - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_02eea1aa\Report.wer - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1265f538 - Deleted
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_dc7c09b5b22497c66105fec8cf4793ba24a83ae_676f2386_1265f538\Report.wer - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC592.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC592.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5C1.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5C1.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8B0.tmp
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug - Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\IdentityCRL\ClockData - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHivePermissionsCorrect - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHiveOwnerCorrect
Show all 16 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug\ExceptionRecord - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData\ClockTimeSeconds - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData\TickCount - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\ProgramId - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\FileId - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\LowerCaseLongPath - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\LongPathHash - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\Name - Set
\REGISTRY\A\{454a5d5c-154e-f9bd-99c9-2547c68047ae}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\Publisher - Deleted
\REGISTRY\A\{89873fd2-13bb-b02c-588f-365e91ff6438}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess1820Global\AmiProviderMutex_InventoryApplicationFileGlobal\c4c5df13-409b-4dcf-96bf-74cb84329887\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2356\Sessions\1\BaseNamedObjects\Global\69a8db4a-9358-4623-83cf-db62de37d8df\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5564
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\a37b0221-aee9-4825-b747-5a5c5d0bdbde\Sessions\1\BaseNamedObjects\Global\34a0b669-b738-4c1e-af50-b9a8b5d28660\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2540
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
svc.ha-teams.office.com - VM host
svc.ms-acdc-teams.office.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- c7ddf58ba2ddf75443eb…293973Not checkedno saved verdict
- d2f808e93b454083998d…525b73Not checkedno saved verdict
- 0d6538c945faffcb71f8…66a4faNot checkedno saved verdict
- cc6db993371bc20cd5c6…66ac34Not checkedno saved verdict
- 750911d608f0c207776f…220cfeNot checkedno saved verdict
- 990e0b43c97fd397416d…8adcffNot checkedno saved verdict
- da8cc0135a733e6f3494…32ac5eNot checkedno saved verdict
- 8a65084496ee21d96543…1d5822Not checkedno saved verdict
- 3cfb96b7059f2f739aef…e6bf0dNot checkedno saved verdict
- d09b0e249e9659ae875c…930b2fNot checkedno saved verdict
Chapter 04
Technical details
2 of the 62 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- APEXMalicious
- CynetMalicious (score: 100)
File fingerprint
- Last analyzed
- Nov 7, 2026, 2:19 AM UTC
- SHA-256
21fbd320f805e0de095c0b0f517165fffe1122c97553cac33ee033bf78478014- SHA-1
5356f71c645fd289c37f15ba0d3d181c47460f16- MD5
82642007ad25e945f86131d4d56a76e5
About this file
version.dll is a Win32 DLL file of 386.0 kB.
- Type and size
- Win32 DLL · 386.0 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 13, 2022On VirusTotal.
- Submitted by
- 292 distinct sources
- Packer
- None detected
- Entropy
- 5.92 of 8
First scanned
Antivirus consensus
2 of 62 engines flagged this file
13 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-115 engines0flagged
- Tier-232 engines0flagged
- Low-trust15 engines2flagged
View all 75 engine results
- APEXMalicious: Malicious
- CynetMalicious: Malicious (score: 100)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWNo result
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is version.dll safe?
What is version.dll?
How many antivirus engines detected version.dll?
What is the SHA-256 hash of version.dll?
Is it safe to use version.dll?
How up to date is this analysis of version.dll?
Community
Member reviews and reports for this exact file hash.