Our call: Is CH341SER.EXE safe?Safe
Zero detections across 74 engines, valid code signature, and no malicious sandbox verdict despite heuristic MITRE mappings.
- 0 of 74 antivirus engines flagged the file.Observed · Antivirus analysis
- The file has a valid code signature from Nanjing Qinheng Microelectronics Co..Observed · Code-signing metadata
- 1 high-confidence signature or behavior rule matched this file.Derived · Signature and behavior rules
458c37bdafbe4ce3cd…099212cad1Recommended next actions
Before running
Run it only when it came from the developer's official site or another source you independently trust.
If you already ran it
Keep normal device protection enabled and stop if the file behaves unexpectedly.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete0 of 74 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
Complete2 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
CH341SER.EXE
458c37bdafbe4ce3cd0baf728c232b4b765b36d7463956e9b94cdf099212cad1
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\CH341SER.EXE"
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\system32\services.exe
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
__tmp_rar_sfx_access_check_46578
C:\WCH.CN\CH341SER\__tmp_rar_sfx_access_check_46578
04Isolated runtime analysis - Written fileObserved
CH341S98.SYS
C:\WCH.CN\CH341SER\CH341S98.SYS
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
0 of 74 antivirus engines flagged the file.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The file has a valid code signature from Nanjing Qinheng Microelectronics Co..
ProvenanceObservedSourceCode-signing metadataObserved at - 03
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 04
Scanned file: CH341SER.EXE — 458c37bdafbe4ce3cd0baf728c232b4b765b36d7463956e9b94cdf099212cad1
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\CH341SER.EXE"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\system32\services.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: __tmp_rar_sfx_access_check_46578 — C:\WCH.CN\CH341SER\__tmp_rar_sfx_access_check_46578
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: CH341S98.SYS — C:\WCH.CN\CH341SER\CH341S98.SYS
ProvenanceObservedSourceIsolated runtime analysisObserved at
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
All 74 engines returned clean. The file is signed by Nanjing Qinheng Microelectronics Co. and the sandbox produced no malicious verdict. Heuristic rules flagged LSASS access and process injection, but these remain unconfirmed by any engine label.
The complete absence of malicious detections from 17 tier-1 and 40 tier-2 engines outweighs the heuristic MITRE mappings. The certificate is valid and brand mismatch is absent. While the sandbox observed LSASS interaction, no dropped malicious children or malicious host contacts exist. Medium prevalence and lack of prior signer history keep the confidence moderate rather than maximal.
What We Detected
74 engines scanned the 799 kB Win32 executable; none flagged it malicious or suspicious. The binary carries a valid digital signature from Nanjing Qinheng Microelectronics Co. Sandbox execution wrote driver files under C:\WCH.CN\CH341SER\ and touched LSASS, triggering two heuristic rules (T1055, credential-dumping shape), yet no engine corroborated malice.
Threat Behavior
Observed techniques map to process injection and LSASS access, but these appear within a driver-installer context. No C2 traffic, persistence mechanisms, or malicious child processes were recorded. External-intel sources returned no hits.
What To Do Now
Keep Windows Defender and other endpoint protection enabled. If the file is a USB-serial driver from the vendor’s official site, installation is low-risk; otherwise obtain it directly from the manufacturer.
Where this verdict could be wrong2 caveats
- Sandbox observed LSASS access and process-injection techniques (T1055, T1134, T1543.003) that legitimate drivers rarely need; absence of malicious engine labels does not rule out dual-use or supply-chain risk.
- signerStats.found=false — no historical samples for 'Nanjing Qinheng Microelectronics Co.' means we cannot rely on prior clean reputation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/74 engines flagged malicious
- Valid code signature, no brand mismatch
- No malicious dropped children
- Sandbox observed LSASS access (T1134)
- No prior signer history available
The file can be executed if obtained from the legitimate vendor; otherwise treat as untrusted.
Behavior
Plain-English impact first, then the observed runtime evidence.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\WCH.CN\CH341SER\__tmp_rar_sfx_access_check_46578
- C:\WCH.CN\CH341SER\CH341S98.SYS
- C:\WCH.CN\CH341SER\CH341SER.CAT
- C:\WCH.CN\CH341SER\CH341SER.INF
- C:\WCH.CN\CH341SER\CH341SER.sys
- C:\WCH.CN\CH341SER\__tmp_rar_sfx_access_check_46578
- __tmp_rar_sfx_access_check_234703
- C:\WCH.CN\CH341SER\__tmp_rar_sfx_access_check_4704562
- \Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 1bbb1dfe5e311f53c2ae…f729dfNever scannednever seen before
- b5d55fa31753fcd86145…876c4cNever scannednever seen before
- d1f001401a28e43e20a3…cb4237Never scannednever seen before
- ef2afbb2679added7125…65154cNever scannednever seen before
- cb0fb42b6b3ba62aff19…bf4f91Never scannednever seen before
- bd849760a396ce7e9b0b…5110cfNever scannednever seen before
- 2a946f316edd7e1185de…cd0daeNever scannednever seen before
- 222f91aaeeda5d834855…0ffc74Never scannednever seen before
- b89fd6c6a1eb20df0fb3…0ffaa2Never scannednever seen before
- 9e79736e949897b8ff8e…ef7e05Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Detection sources at a glance
The available sources did not agree on a named threat category.
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exe
0 of 74 engines flagged this file
View all 74 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- CH341SER.EXE
- Format
- Win32 EXE
- Code signing
- Signature valid: Nanjing Qinheng Microelectronics Co.
- Size
- 780.4 KB
- Last analyzed
- Jul 27, 2026, 3:11 PM UTC
458c37bdafbe4ce3cd0baf728c232b4b765b36d7463956e9b94cdf099212cad1Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file appears low risk based on the evidence available now.
Run it only when it came from the developer's official site or another source you independently trust.
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
Keep your antivirus and Windows updates switched on so you stay protected.