File scan report
Verdict Safe
Is CMT_
Only 1 of the 70 antivirus engines that checked it flagged this long-established DLL, while every major engine remained silent and no corroborated malicious behavior was recorded.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 12y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Cynet alone flagged the DLL, while the other 74 of the 70 antivirus engines that checked it did not, including all reporting major engines. Its history spans 117 submitters since it was first seen on Mar 25, 2014, and the sandbox evidence does not substantiate process injection, making the isolated detection likely a false positive.
The strongest signal is the antivirus result: only 1 of the 70 antivirus engines that checked it flagged the file, and that detection came from a less reliable engine with no named malware family. All 18 reporting major engines remained silent, and there is no corroborating malicious sandbox verdict. The file also has broad, long-standing prevalence, with 117 distinct submitters and a first-seen date of Mar 25, 2014. Although the DLL is unsigned and UPX-packed, those properties are not proof of malware. A label was recorded without any named injection target, so it does not establish that process injection occurred. Two IP contacts warrant caution because no complete reputation result is available, but they do not outweigh the broader benign evidence.
What We Detected
Only Cynet flagged the DLL, producing 1 detection out of 75 engines. The remaining engines did not flag it, including all 18 reporting major engines, and no engine identified a real malware family.
Threat Behavior
The sandbox summary included a T1055 label, but it recorded no process targeted for injection, so that label does not demonstrate actual process injection. Two IP contacts were observed, although a complete reputation assessment for those hosts is not available. No malicious sandbox verdict or malicious dropped file was recorded.
Additional Context
The DLL is unsigned and compressed with UPX, with high-entropy code. These traits can conceal code and justify caution, but they are also found in legitimate software. The sample has substantial history across 117 distinct submitters and was first seen on Mar 25, 2014, which weighs strongly against the isolated detection.
What To Do Now
Use the DLL only if it came from the expected software package or another trusted source. Keep security software enabled and rescan if the file changes or begins producing unexpected network or application behavior.
Where this verdict could be wrong3 caveats
- The DLL is unsigned and UPX-packed, which makes its contents less transparent and warrants obtaining it from a trusted source.
- The sandbox summary recorded two IP contacts, but no complete host-reputation assessment is available.
- Our static analysis was not available, so the packed contents were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 70 antivirus engines that checked it flagged the file, and the sole detection came from a less reliable engine.
- All 18 reporting major engines remained silent.
- The sample has been submitted by 117 distinct sources and was first seen on Mar 25, 2014.
- No malicious sandbox verdict or corroborated process-injection target was recorded.
- No inspected dropped file was identified as malicious.
- The DLL is unsigned.
- The executable code is compressed with UPX and has high entropy.
- The sandbox summary recorded two IP contacts whose reputations were not fully assessed.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 0spawned processes
- 2network contacts
- 35filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1018
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
- T1095· Custom network
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
Observed activity
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
13.64.90.137 - IP address
13.88.21.125
Files
30Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_4ebb56b2cd65abaa97ed7bce233e92fcad57e5c_82810a17_0fa1674f - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_4ebb56b2cd65abaa97ed7bce233e92fcad57e5c_82810a17_0fa1674f\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_4ebb56b2cd65abaa97ed7bce233e92fcad57e5c_82810a17_1d696888 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_4ebb56b2cd65abaa97ed7bce233e92fcad57e5c_82810a17_1d696888\Report.wer - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45CD.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45CD.tmp.dmp
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D02.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D02.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FF1.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FF1.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5175.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5175.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A6F.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A6F.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CC2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45CD.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45CD.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D02.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D02.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FF1.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FF1.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER500E.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5175.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5175.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER53C8.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A6F.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A6F.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CC2.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CC2.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CF1.tmp.csv
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7260\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\1b5522d1-5aae-48fa-9e16-4317499520e4\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500\Sessions\1\BaseNamedObjects\Global\878da1c0-bb83-4851-9cb4-5baab417d04e
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- afb1e15cfac2f011ee03…cb6473Not checkedno saved verdict
- c04aadece7310a678a38…5e1c50Not checkedno saved verdict
- a1ac7121f56677b6ed42…c8d43dNot checkedno saved verdict
- 11412e22689d2e66c51f…236aaeNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CynetMalicious (score: 100)
File fingerprint
- Last analyzed
- Sep 6, 2026, 7:24 PM UTC
- SHA-256
36955430d0ed08f6b937c554377c02b5181ef274a84d02dafe43c01faf61db73- SHA-1
23d8b54373a7c6e4b991536d54fd6aabfe507c5f- MD5
ab45ee71a9abb17c365f52f77e986198
About this file
CMT_Bitcrusher_2.dll is a Win32 DLL file of 667.1 kB.
- Type and size
- Win32 DLL · 667.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 25, 2014On VirusTotal.
- Submitted by
- 117 distinct sources
- Packer
- UPX (section names)Packing hides code; legitimate installers use it too.
- Entropy
- 7.92 of 8A code section is highly compressed or encrypted.
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- CynetMalicious: Malicious (score: 100)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidence13.64.90.137
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is CMT_Bitcrusher_2.dll safe?
What is CMT_Bitcrusher_2.dll?
How many antivirus engines detected CMT_Bitcrusher_2.dll?
What is the SHA-256 hash of CMT_Bitcrusher_2.dll?
Is it safe to use CMT_Bitcrusher_2.dll?
How up to date is this analysis of CMT_Bitcrusher_2.dll?
Community
Member reviews and reports for this exact file hash.