winmm.dll

  • File Path: C:\Windows\system32\winmm.dll
  • Description: MCI API DLL

Hashes

Type Hash
MD5 12352383E70B0C7D1588BF896DE0E371
SHA1 5994176E83A3D58CF44E3B2CF85FC0DB63AAFCA7
SHA256 DA82D168ECCBED5434B84786F6BB4ABC43AC6F9F5D04DFDD041CBA423E0EE50A
SHA384 F6CBF2595D01AAA058E9D12FB9D702CD020842B37DF398CB6D715E90416680F9ADA744FDAD5DB72F3D62FABD69664292
SHA512 A15E030E19122FA06CC8FC7BB2B265A35953204D100895C5558D80A08E55E212CF3B2DB6A544FAE58D073FC44BED2F719146FFB8B8566FF270D1AAFF912D806E
SSDEEP 3072:J9IQrhbpdy/tn7G/Ca7QRm8HKIRVnASeIqWJk2RbyTZLhfyoV:bI4kt7G7B8HK+6nWJEh
IMP 053F233E499DD415931815DCCEF4F401
PESHA1 41E5607B36A090FB18544AC8D4547B8FCCD4EE2E
PE256 62C7C4EBC01628B5F14C9D36E5C104AF8B8EB4EC8D3CE6D25BFCF30FD5885E5A

DLL Exports:

Function Name Ordinal Type
mmioWrite 133 Exported Function
mmioStringToFOURCCW 132 Exported Function
mmsystemGetVersion 134 Exported Function
mmTaskCreate 110 Exported Function
mmTaskBlock 109 Exported Function
mmioStringToFOURCCA 131 Exported Function
mmioSeek 127 Exported Function
mmioRenameW 126 Exported Function
mmioSendMessage 128 Exported Function
mmioSetInfo 130 Exported Function
mmioSetBuffer 129 Exported Function
sndPlaySoundA 135 Exported Function
SendDriverMessage 13 Exported Function
sndPlaySoundW 136 Exported Function
timeEndPeriod 138 Exported Function
timeBeginPeriod 137 Exported Function
PlaySoundW 12 Exported Function
mmTaskYield 112 Exported Function
mmTaskSignal 111 Exported Function
OpenDriver 9 Exported Function
PlaySoundA 11 Exported Function
PlaySound 10 Exported Function
mmioRenameA 125 Exported Function
mixerSetControlDetails 106 Exported Function
mixerOpen 105 Exported Function
mmDrvInstall 107 Exported Function
mmioAdvance 113 Exported Function
mmGetCurrentTask 108 Exported Function
mixerMessage 104 Exported Function
mixerGetLineControlsW 100 Exported Function
mixerGetLineControlsA 99 Exported Function
mixerGetLineInfoA 101 Exported Function
mixerGetNumDevs 103 Exported Function
mixerGetLineInfoW 102 Exported Function
mmioInstallIOProcW 121 Exported Function
mmioInstallIOProcA 120 Exported Function
mmioOpenA 122 Exported Function
mmioRead 124 Exported Function
mmioOpenW 123 Exported Function
mmioGetInfo 119 Exported Function
mmioClose 115 Exported Function
mmioAscend 114 Exported Function
mmioCreateChunk 116 Exported Function
mmioFlush 118 Exported Function
mmioDescend 117 Exported Function
waveOutGetPlaybackRate 169 Exported Function
waveOutGetPitch 168 Exported Function
waveOutGetPosition 170 Exported Function
waveOutMessage 172 Exported Function
waveOutGetVolume 171 Exported Function
waveOutGetNumDevs 167 Exported Function
waveOutGetDevCapsW 163 Exported Function
waveOutGetDevCapsA 162 Exported Function
waveOutGetErrorTextA 164 Exported Function
waveOutGetID 166 Exported Function
waveOutGetErrorTextW 165 Exported Function
waveOutSetVolume 180 Exported Function
waveOutSetPlaybackRate 179 Exported Function
waveOutUnprepareHeader 181 Exported Function
WOWAppExit 14 Exported Function
waveOutWrite 182 Exported Function
waveOutSetPitch 178 Exported Function
waveOutPause 174 Exported Function
waveOutOpen 173 Exported Function
waveOutPrepareHeader 175 Exported Function
waveOutRestart 177 Exported Function
waveOutReset 176 Exported Function
waveOutClose 161 Exported Function
waveInGetDevCapsA 146 Exported Function
waveInClose 145 Exported Function
waveInGetDevCapsW 147 Exported Function
waveInGetErrorTextW 149 Exported Function
waveInGetErrorTextA 148 Exported Function
waveInAddBuffer 144 Exported Function
timeGetSystemTime 140 Exported Function
timeGetDevCaps 139 Exported Function
timeGetTime 141 Exported Function
timeSetEvent 143 Exported Function
timeKillEvent 142 Exported Function
waveInStart 157 Exported Function
waveInReset 156 Exported Function
waveInStop 158 Exported Function
waveOutBreakLoop 160 Exported Function
waveInUnprepareHeader 159 Exported Function
waveInPrepareHeader 155 Exported Function
waveInGetNumDevs 151 Exported Function
waveInGetID 150 Exported Function
waveInGetPosition 152 Exported Function
waveInOpen 154 Exported Function
waveInMessage 153 Exported Function
mciGetDriverData 39 Exported Function
mciGetDeviceIDW 38 Exported Function
mciGetErrorStringA 40 Exported Function
mciGetYieldProc 42 Exported Function
mciGetErrorStringW 41 Exported Function
mciGetDeviceIDFromElementIDW 37 Exported Function
mciFreeCommandResource 33 Exported Function
mciExecute 3 Exported Function
mciGetCreatorTask 34 Exported Function
mciGetDeviceIDFromElementIDA 36 Exported Function
mciGetDeviceIDA 35 Exported Function
midiConnect 50 Exported Function
mciSetYieldProc 49 Exported Function
midiDisconnect 51 Exported Function
midiInClose 53 Exported Function
midiInAddBuffer 52 Exported Function
mciSetDriverData 48 Exported Function
mciSendCommandA 44 Exported Function
mciLoadCommandResource 43 Exported Function
mciSendCommandW 45 Exported Function
mciSendStringW 47 Exported Function
mciSendStringA 46 Exported Function
mciDriverYield 32 Exported Function
DefDriverProc 5 Exported Function
CloseDriver 4 Exported Function
DriverCallback 6 Exported Function
GetDriverModuleHandle 8 Exported Function
DrvGetModuleHandle 7 Exported Function
auxSetVolume 20 Exported Function
auxGetDevCapsW 16 Exported Function
auxGetDevCapsA 15 Exported Function
auxGetNumDevs 17 Exported Function
auxOutMessage 19 Exported Function
auxGetVolume 18 Exported Function
joyReleaseCapture 28 Exported Function
joyGetThreshold 27 Exported Function
joySetCapture 29 Exported Function
mciDriverNotify 31 Exported Function
joySetThreshold 30 Exported Function
joyGetPosEx 26 Exported Function
joyGetDevCapsA 22 Exported Function
joyConfigChanged 21 Exported Function
joyGetDevCapsW 23 Exported Function
joyGetPos 25 Exported Function
joyGetNumDevs 24 Exported Function
midiOutUnprepareHeader 84 Exported Function
midiOutShortMsg 83 Exported Function
midiStreamClose 85 Exported Function
midiStreamOut 87 Exported Function
midiStreamOpen 86 Exported Function
midiOutSetVolume 82 Exported Function
midiOutMessage 78 Exported Function
midiOutLongMsg 77 Exported Function
midiOutOpen 79 Exported Function
midiOutReset 81 Exported Function
midiOutPrepareHeader 80 Exported Function
mixerGetControlDetailsW 95 Exported Function
mixerGetControlDetailsA 94 Exported Function
mixerGetDevCapsA 96 Exported Function
mixerGetID 98 Exported Function
mixerGetDevCapsW 97 Exported Function
mixerClose 93 Exported Function
midiStreamPosition 89 Exported Function
midiStreamPause 88 Exported Function
midiStreamProperty 90 Exported Function
midiStreamStop 92 Exported Function
midiStreamRestart 91 Exported Function
midiOutGetVolume 76 Exported Function
midiInOpen 61 Exported Function
midiInMessage 60 Exported Function
midiInPrepareHeader 62 Exported Function
midiInStart 64 Exported Function
midiInReset 63 Exported Function
midiInGetNumDevs 59 Exported Function
midiInGetDevCapsW 55 Exported Function
midiInGetDevCapsA 54 Exported Function
midiInGetErrorTextA 56 Exported Function
midiInGetID 58 Exported Function
midiInGetErrorTextW 57 Exported Function
midiOutGetErrorTextA 72 Exported Function
midiOutGetDevCapsW 71 Exported Function
midiOutGetErrorTextW 73 Exported Function
midiOutGetNumDevs 75 Exported Function
midiOutGetID 74 Exported Function
midiOutGetDevCapsA 70 Exported Function
midiInUnprepareHeader 66 Exported Function
midiInStop 65 Exported Function
midiOutCacheDrumPatches 67 Exported Function
midiOutClose 69 Exported Function
midiOutCachePatches 68 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: WINMM.DLL.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/da82d168eccbed5434b84786f6bb4abc43ac6f9f5d04dfdd041cba423e0ee50a/detection/

Possible Misuse

The following table contains possible examples of winmm.dll being misused. While winmm.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_uac_bypass_winsat.yml - '\AppData\Local\Temp\system32\winmm.dll' DRL 1.0
malware-ioc win_apt_invisimole_wrapper_dll.yml - 'Windows\winmm.dll' © ESET 2014-2018
malware-ioc win_apt_invisimole_wrapper_dll.yml - '\winmm.dll' © ESET 2014-2018

MIT License. Copyright (c) 2020-2021 Strontic.