dbghelp.dll

Windows Image Helper file version info

Library on Windows 13 known copies with hashes 11 Sigma rules name it

Is it the real dbghelp.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\

Signed byMicrosoft Corporation

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Image Helper

13 known copies

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dbghelp.dll · signed by Microsoft Windows

44ebb59642ecf3c6d9bac583c2f640863b4af9cddb0718eb4f8e5e2bb1f06cd2

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\dbghelp.dll · signed by Microsoft Windows

735d07693cfbc08330e322675815ed1de7b53f4e8fd970dbaaa9fd842e7e68c3

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\dbghelp.dll · signed by Microsoft Corporation

0652df4c785b4e9bfc5d7b7feda32ec595e6fc73f708de9a3c51e89bb56ea51e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\srcsrv\dbghelp.dll · signed by Microsoft Corporation

095a95c8423633d08a3692c2d1bf7ea71885d63cb02348be85831a6a240ead7c

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\srcsrv\dbghelp.dll · signed by Microsoft Corporation

383795d26caa03c65392201dc0aa1895558a8f147f237d3693887435b4e835d4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\dbghelp.dll · signed by Microsoft Corporation

6000786b52180d0c1dcecd683d6b88685f81865186d61a5230d073644d2f52fa

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\srcsrv\dbghelp.dll · signed by Microsoft Corporation

63e1beb7539bda9b47289800108231452962b1608e37546291d19a5d26b0cc60

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbghelp.dll · signed by Microsoft Corporation

86e6a1c7927451292a7abd3803280e1f1d5abf09e9785dc30f512803e9383bb1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\srcsrv\dbghelp.dll · signed by Microsoft Corporation

8edde3551ba4ae1c8b36b6f3e0ccc3a6886eebe7457808a8d442a54b34451cda

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll · signed by Microsoft Corporation

9a02133854ff9f06c3b23a70f8c2a4814b2ed4eef613244b485e3737259ddf9e

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Microsoft Office\root\Office16\DBGHELP.DLL · signed by Microsoft Corporation

f91c9481803309d99456968e92c2df97b3ed060dd90509addc67e7cb1e7aaaaf

6.12.0002.633 (debuggers(dbg).100201-1203) · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll · signed by Microsoft Corporation

c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

6.7.0005.1 (debuggers(dbg).070515-1751) · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\dbghelp.dll · signed by Microsoft Corporation

ffd4edfbe5a42d99e627aca1090b7c886de666a86d9ecd98f55e1395d0eaf6e1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names dbghelp.dll in 11 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.