dbgcore.dll

Windows Core Debugging Helpers file version info

Library on Windows 11 known copies with hashes 9 Sigma rules name it

Is it the real dbgcore.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\srcsrv\

Signed byMicrosoft Corporation

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Core Debugging Helpers

11 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\srcsrv\dbgcore.dll · signed by Microsoft Corporation

09c8084e8fa3ddf0ae32c9e14ea39584b08c6ac4a1655c28ad7b5cbc6dcfefeb

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\srcsrv\dbgcore.dll · signed by Microsoft Windows Kits Publisher

1e1c6f4292da8ae9e2a70a809125507acd936bd8b5f1ba95a8d75730b5c2ca7b

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbgcore.dll · signed by Microsoft Corporation

4aa03e8a3a89835d2fe52375f2032002d5fc468a38a885ba306eb1f154e2251f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\srcsrv\dbgcore.dll · signed by Microsoft Corporation

5850bf81cf88914ec709f8a56ba8eb119f7ec82b204fa3ca3193e3fa268dfbc8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\dbgcore.dll · signed by Microsoft Windows Kits Publisher

8a45e93a18227544a3d465510bdb7e442d85cc1aac8d60d44218d008abce37c7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dbgcore.dll · signed by Microsoft Windows

c6b895f9d45f733ea753ad5e59a60213f2ce2291c8038194a809ea5d09d774a3

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbgcore.dll · signed by Microsoft Corporation

c988d044ecee004544abeafc602cabb48202249417e4ebc5a1d56ea920884b97

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dbgcore.dll · signed by Microsoft Windows

ce76d374bf58239f7f4a16aea2e6152537437af8aa3c83c59cccc88daffccc85

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\dbgcore.dll · signed by Microsoft Windows Kits Publisher

de927fbcd3f8ece16ef13067ba7fe1c9c6c2731ffcf86cbe858b752a3b7b16b8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\srcsrv\dbgcore.dll · signed by Microsoft Windows Kits Publisher

e0f1eba3c311c90cfaba0da7bcf167ad0654c77521b75f5955f7aab62baf8ee1

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Microsoft Office\root\Office16\DBGCORE.DLL · signed by Microsoft Corporation

3147513b5b3ddfa690f305e9509ad935259773b7c90e359991d66b0f7c962706

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names dbgcore.dll in 9 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.