File scan report
Verdict Suspicious
Is solaris 26.
This unsigned 64-bit DLL is flagged by 7 of the 67 antivirus engines that checked it, including Microsoft and Symantec, but only with generic machine-learning labels and no named…
Read the whole reasonShow less
Why Suspicious? 7 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid loading this DLL unless it comes from a source you trust, and keep your antivirus protection enabled; scan the system if it has already been run.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't use it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
7 of 67 flagged
- Flagged 7
- No detection 60
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Fifteen other major antivirus engines did not flag it, and no malware database or family rule matches it. The evidence leans against the file without proving it is malware.
Microsoft and Symantec, two major antivirus engines, flag the DLL with machine-learning labels, and CrowdStrike reports high confidence of malice. None of these detections names a malware family, and most major antivirus engines did not flag it. The file is unsigned and carries tags for debugger-environment checks and long sleeps, traits seen in both protected tools and evasive malware. The sandbox summary recorded no injected processes, no network contacts and no hostile verdict. With 159 submitters and no public malware listings, the detections may be rule-based false positives, but they cannot be dismissed.
What We Detected
7 of the 67 antivirus engines that checked it flagged this unsigned 64-bit DLL. Microsoft (Trojan:Win32/Wacatac.B!ml) and Symantec (ML.Attribute.HighConfidence) are major antivirus engines using machine-learning labels; CrowdStrike reports high confidence, and four less reliable engines add generic or hash-reputation hits. No malware family is named, and no public malware database or family-specific rule matches the file. It was first seen on Jun 29, 2026 and submitted by 159 sources.
Threat Behavior
The sandbox runs loaded the DLL through rundll32 and recorded no injected processes, no network contacts and no persistence. The file includes checks for debugging environments and long sleep calls, which can be anti-analysis behaviour or ordinary software protection. Contacted-host reputation was not available.
What To Do Now
Do not load this DLL unless you trust its source. If it came bundled with a game modification or similar tool, treat it with caution, keep your antivirus enabled, and scan your system if you have already run it.
Where this verdict could be wrong2 caveats
- 15 major antivirus engines, including Kaspersky, ESET and BitDefender, did not flag the file, and every detection is a generic or machine-learning label rather than a named family.
- The DLL was submitted by 159 sources and has no malware-specific rule matches or public malware-database listing, which fits a widely shared tool flagged by heuristics.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 15 major antivirus engines did not flag the file
- No match in public malware databases or malware-specific rules
- Submitted by 159 different sources
- The sandbox runs recorded no process injection or network contacts
- Two major antivirus engines, Microsoft and Symantec, flag the file with machine-learning detections
- CrowdStrike reports high confidence that the file is malicious
- The DLL is unsigned, so its author cannot be verified
- The file checks for debugging environments and uses long sleeps, traits also used to evade analysis
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 20sandbox rule tags
- 4spawned processes
- 0network contacts
- 12filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
solaris 26.3X.dll
446d92a50fdb78a29a5d2bf213ac5a24d8fe3b1bb4e8dbb4135c74ad6386c3e0
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\solaris.dll",#1
Test run - Evidence 3 of 5: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\solaris.dll"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Temp
C:\ProgramData\Microsoft\Windows\WER\Temp
Test run - Evidence 5 of 5: Written fileSeen in the test run
2413a2e8-bfca-4282-b009-b3b4d3bf6c92
C:\ProgramData\Microsoft\Windows\WER\Temp\2413a2e8-bfca-4282-b009-b3b4d3bf6c92
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
20MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1056· Keylogging
- T1056.001· Keylogging
- T1057· Lists programs
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1542.003
- T1562.001· Disables security
- T1574· Execution hijack
- T1614
- T1620· In-memory loading
Observed activity
Processes started
4Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\solaris.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\solaris.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\solaris.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\solaris.dll",#1
Files
10Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2413a2e8-bfca-4282-b009-b3b4d3bf6c92 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\043c7acb-2a62-4526-8fc6-616d201ab5cd - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\171723ac-a221-495a-8bd4-95c7780e2667
Show all 10 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\1824bee1-88d5-4d85-ad1f-f487bc455bf8 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2f7cf66e-db29-40d7-bf29-c8432ba5b126 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\edf2f6ec-dd29-4ca8-8021-3fc77c2c7142 - Written
\Device\ConDrv\\Connect
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
\REGISTRY\A\{eccd4aa0-27f4-abca-aa99-6adaeab98bbd}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7096\Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex4216
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6072 -s 616 - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7096 -s 452
Chapter 04
Technical details
7 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 7
- Microsoft (major engine)Trojan:Win32/Wacatac.B!ml
- Symantec (major engine)ML.Attribute.HighConfidence
- APEXMalicious
- BkavW32.Malware.A8965F5E
- CrowdStrikewin/malicious_confidence_100% (D)
- CynetMalicious (score: 100)
- McAfeeDti!446D92A50FDB
File fingerprint
- Last analyzed
- Jul 22, 2026, 1:40 PM UTC
- SHA-256
446d92a50fdb78a29a5d2bf213ac5a24d8fe3b1bb4e8dbb4135c74ad6386c3e0- SHA-1
3a0cbbb85979f52e366cb1345bae384007aaa284- MD5
eb82b9d2b84cc712cdad3ddfcd128c12
About this file
solaris 26.3X.dll is a Win32 DLL file of 370.2 kB.
- Type and size
- Win32 DLL · 370.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 29, 2026On VirusTotal.
- Submitted by
- 159 distinct sources
- Packer
- None detected
- Entropy
- 6.03 of 8
First scanned Updated
Antivirus consensus
7 of 67 engines flagged this file
7 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines2flagged
- Tier-233 engines1flagged
- Low-trust17 engines4flagged
View all 74 engine results
- APEXMalicious: Malicious
- BkavMalicious: W32.Malware.A8965F5E
- CrowdStrikeMalicious: win/malicious_confidence_100% (D)
- CynetMalicious: Malicious (score: 100)
- McAfeeDMalicious: ti!446D92A50FDB
- MicrosoftMalicious: Trojan:Win32/Wacatac.B!ml
- SymantecMalicious: ML.Attribute.HighConfidence
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXClean
- CylanceClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is solaris 26.3X.dll safe, or is it malware?
What is solaris 26.3X.dll?
How many antivirus engines detected solaris 26.3X.dll?
What should I do if I already used solaris 26.3X.dll?
What is the SHA-256 hash of solaris 26.3X.dll?
How up to date is this analysis of solaris 26.3X.dll?
Community
Member reviews and reports for this exact file hash.