Is dwmapi.dll safe?
Thirty-one of 75 engines flagged this unsigned DLL, including eight tier-1 detections, with repeated Wacatac or generic-trojan labels and defense-impairment behavior.
Thirty-one of 75 engines detected the DLL, including eight tier-1 engines such as Microsoft, BitDefender, Sophos, and TrendMicro. Repeated Wacatac and generic-trojan labels, an unsigned executable, and observed T1562.001 defense impairment make execution unsafe despite the lack of one strong family consensus.
f44fb5b9444720a6c4…acef06b40f80c2Recommended next actions
Before using
Do not use it. Quarantine this component with your antivirus, then repair or reinstall the parent software from its official source. Do not delete or replace the component manually.
If you already used it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Thirty-one of 75 engines detected the DLL, including eight tier-1 engines such as Microsoft, BitDefender, Sophos, and TrendMicro. Repeated Wacatac and generic-trojan labels, an unsigned executable, and observed T1562.001 defense impairment make execution unsafe despite the lack of one strong family consensus.
The detection volume is substantial: 31 of 75 engines flagged the sample, including eight high-trust detections. Microsoft and TrendMicro identify Wacatac variants, while several other engines use generic-trojan or Agent labels, supporting a broad trojan assessment rather than a definitive family attribution. The DLL is unsigned and has no established publisher history to offset those findings. One sandbox run recorded T1562.001, which concerns impairing security defenses, as well as direct traffic to 162.159.36.2. No complete host-reputation result is available because the contacted-host check was not saved, and the sandbox itself did not issue a malicious verdict, but these limitations do not outweigh the multi-engine evidence.
What We Detected
31 of 75 antivirus engines flagged this Win32 DLL. Eight tier-1 detections include Microsoft reporting Trojan:Win32/Wacatac.B!ml, TrendMicro reporting Trojan.Win64.WACATAC.USBLHU26, and BitDefender reporting Trojan.GenericKD.81301679. The file is unsigned and has no known signer history.
Threat Behavior
One completed sandbox run recorded MITRE technique T1562.001, associated with attempts to impair security defenses. The sample was loaded through rundll32.exe and regsvr32.exe and contacted 162.159.36.2 directly. The direct-IP heuristic is supporting evidence only, and no complete reputation result is available for that IP because the contacted-host cross-check was not saved. No persistence indicators, dropped hashes, or explicit malicious sandbox verdict were recorded.
What To Do Now
Do not load, register, or execute this DLL. Keep endpoint protection enabled, quarantine the file, and run a full system scan; if it already ran, isolate the affected device and review security logs for rundll32.exe or regsvr32.exe activity involving the sample.
Where this verdict could be wrong5 caveats
- engines.tier1FamilyConsensus.strong=false; labels span Wacatac, Agent, MalwareX, and generic trojan names rather than one established family.
- behaviour.hasMaliciousSandboxVerdict=false, and the completed run produced no persistence indicators or dropped file hashes.
- externalIntel.yaraify.ruleCount=0, externalIntel.circl.hit=false, and externalIntel.malwareBazaar.hit=false, although absence of these hits does not outweigh the engine evidence.
- peAnalysis.highEntropyCode=false and peAnalysis.likelyPacked=false, so packing or unusually opaque code was not detected.
- contactedHosts=null, preventing a completed reputation assessment of the observed IP address.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- behaviour.hasMaliciousSandboxVerdict=false
- No persistenceIndicators or droppedFileHashes were recorded
- peAnalysis.highEntropyCode=false and peAnalysis.likelyPacked=false
- externalIntel.yaraify.ruleCount=0 and externalIntel.circl.hit=false
- 31/75 antivirus detections
- Eight tier-1 engines detected the sample
- Repeated Wacatac and generic-trojan labels
- Unsigned Win32 DLL with no signer history
- Observed MITRE T1562.001 defense-impairment behavior
- Direct IP contact to 162.159.36.2 without a completed reputation check
Quarantine the DLL and do not invoke it with rundll32.exe or regsvr32.exe. If it has already executed, keep protection enabled, isolate the system, run a full scan, and investigate related process and network activity.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete31 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 runtime contact was observed without a completed reputation cross-check.
YARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 13MITRE ATT&CK techniques
- 15spawned processes
- 1network contacts
- 23filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Attempted to impair or bypass security controls.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Scans through your files and folders.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Moderate concern: Checks which security software you have installed.
Note: Reads your Windows user-account details.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
dwmapi.dll
f44fb5b9444720a6c4952e2d252df01ffb89d627260f4925b5acef06b40f80c2
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\attachment.dll"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
5a2f2709-bdcb-458c-86d2-e4b41dfe3a2e
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\5a2f2709-bdcb-458c-86d2-e4b41dfe3a2e
04Isolated runtime analysis - Written fileObserved
6a195828-d54a-499c-bcfa-f7d9af8d0ca6
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\6a195828-d54a-499c-bcfa-f7d9af8d0ca6
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
162.159.36.2
Contact observed during runtime.
06Isolated runtime analysis
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 162.159.36.2
- \REGISTRY\A\{3cb4e10e-5d09-83a2-bcf9-622d6f9e4417}\Root\InventoryApplicationFile\PermissionsCheckTestKey
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\5a2f2709-bdcb-458c-86d2-e4b41dfe3a2e
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\6a195828-d54a-499c-bcfa-f7d9af8d0ca6
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\86f79298-01ac-4da5-a584-c45c7340cfd9
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\cd4b7adf-8b94-428d-b6e8-28f4b94fb0aa
- C:\ProgramData\Microsoft\Windows\WER\Temp\220bc5a2-2247-4e13-aae9-907bbb0aba18
- \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7056
- \Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex6280
- \Sessions\1\BaseNamedObjects\Global\4d84982e-a5da-4e28-89fe-12a7c0266955
- \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1456
- \Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex1768
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 31 / 75engines flagged
- 6sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
31 of 75 antivirus engines flagged the file, including alibabacloud and ALYac.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 6 times from 6 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: dwmapi.dll — f44fb5b9444720a6c4952e2d252df01ffb89d627260f4925b5acef06b40f80c2
ProvenanceObservedSourceUploaded fileObserved at - 04
Observed process — "C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\attachment.dll",#1
ProvenanceObservedSourceIsolated runtime analysisObserved at - 05
Observed process — C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\attachment.dll"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
File written: 5a2f2709-bdcb-458c-86d2-e4b41dfe3a2e — C:\ProgramData\Microsoft\Windows\WER\ReportArchive\5a2f2709-bdcb-458c-86d2-e4b41dfe3a2e
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: 6a195828-d54a-499c-bcfa-f7d9af8d0ca6 — C:\ProgramData\Microsoft\Windows\WER\ReportArchive\6a195828-d54a-499c-bcfa-f7d9af8d0ca6
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
Contacted host: 162.159.36.2 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence162.159.36.2
31 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- dwmapi.dll
- Format
- Win32 DLL
- Code signing
- No verified publisher
- Size
- 105.5 KB
- Last analyzed
- Sep 26, 2026, 1:56 PM UTC
f44fb5b9444720a6c4952e2d252df01ffb89d627260f4925b5acef06b40f80c2Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't use this component. Quarantine this component with your antivirus, then repair or reinstall the parent software from its official source. Do not delete or replace the component manually.
- Recovery step 02
If you already used it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Reinstall the parent software from the developer's official site instead of replacing this component by itself.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is dwmapi.dll malware?
What is dwmapi.dll?
How many antivirus engines detected dwmapi.dll?
I already downloaded and used dwmapi.dll — what should I do?
How do I remove dwmapi.dll?
What kind of malware is dwmapi.dll?
What is the SHA-256 hash of dwmapi.dll?
How up to date is this analysis of dwmapi.dll?
Community
Member reviews and reports for this exact file hash.