vcruntime140.dll

Microsoft C Runtime Library file version info

Library on Windows 5 known copies with hashes 1 Sigma rule names it

Is it the real vcruntime140.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Cisco Systems\Cisco Jabber\
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\
C:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Corporation

ProductMicrosoft Visual Studio 2017, Microsoft Corporation

DescriptionMicrosoft C Runtime Library

5 known copies

14.26.28720.3 built by: vcwrkspc · C:\Program Files (x86)\Microsoft\Edge\Application\85.0.564.68\vcruntime140.dll · signed by Microsoft Corporation

dd2d17687691ebffbbf7b8322cb92e4253f3850b0c0e196aae78cfbc585c7b8d

14.16.27033.0 built by: vcwrkspc · C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll · signed by Microsoft Corporation

2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

14.16.27033.0 built by: vcwrkspc · C:\Program Files (x86)\Microsoft Office\root\Client\vcruntime140.dll · signed by Microsoft Corporation

8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

14.00.24210.0 built by: VCTOOLSREL · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\vcruntime140.dll · signed by Microsoft Corporation

6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4

14.00.24210.0 built by: VCTOOLSREL · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\x64\vcruntime140.dll · signed by Microsoft Corporation

d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names vcruntime140.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.