iviewers.dll

OLE/COM Object Interface Viewer file version info

Library on Windows 4 known copies with hashes 1 Sigma rule names it

Is it the real iviewers.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionOLE/COM Object Interface Viewer

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\iviewers.dll · signed by Microsoft Windows Kits Publisher

0340f394832ba81ec2bcbce786910c3993b3b19c6531ee689878a7b9c8ad93e1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\iviewers.dll · signed by Microsoft Corporation

1119214d01e8f279c2fda9988ecc65899bce3864a6a26a661d2b1e22e5d2dab4

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\iviewers.dll · signed by Microsoft Windows Kits Publisher

15730fc16d8fd7b2ee2b027786f9c0b1184bf5dd2f68ee7ae6de4a0069552d18

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\iviewers.dll · signed by Microsoft Corporation

d6991d0fbfe86b24b0ff07c235c890bf8a99278440b2afe083911c2548cff8c4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names iviewers.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.