kernel32.dll: genuine core Windows file, or a fake copy outside System32?

What kernel32.dll does, and why malware uses it without replacing it

kernel32.dll is one of the oldest Windows libraries and is loaded into practically every program that runs on Windows. Programs call it to create, read and write files, reserve memory, start processes and threads, load other DLLs, wait for events and read the system time. Since Windows 7, Microsoft has moved much of that code into KernelBase.dll: kernel32.dll keeps the same function names and forwards many calls to it, so older programs keep working unchanged.

Windows treats kernel32.dll as a known DLL. Its name is listed in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs, and for every DLL on that list Windows uses its own copy instead of searching the program's folder. That is the difference from files such as dinput8.dll, which tools can replace with a proxy in a game or program folder. A kernel32.dll dropped next to an .exe is simply not loaded from there by Windows.

Malware therefore does not need a fake kernel32.dll. It uses the genuine one, the same way every program does: functions such as VirtualAllocEx, WriteProcessMemory and CreateRemoteThread let it write code into another process and run it there, and LoadLibrary loads its own DLLs. Seeing kernel32.dll in a list of loaded modules or in a crash report says nothing about infection, because every process has it.

Where a file named kernel32.dll does matter is outside the Windows folders. Malware authors give their files the names of system files so that a quick look in a folder or a process list does not stand out. Such a file is not Windows' library, whatever its name, and its real nature only shows in its folder, its signature and its hash.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell the genuine kernel32.dll from a copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32, C:\Windows\SysWOW64 and C:\Windows\System32\forwarders are Windows' copies. Copies inside C:\Windows\WinSxS belong to Windows updates and are also genuine. Every other path deserves a closer look.

   Get-ChildItem C:\ -Recurse -Filter kernel32.dll -ErrorAction SilentlyContinue | Where-Object FullName -notlike 'C:\Windows\WinSxS\*' | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the version. Right-click the file, Properties, Details. The genuine file says Windows NT BASE API Client DLL, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100 or 10.0.19041. A copy can imitate these fields, so this check only rules files out.
3. The digital signature. The genuine copies in System32 and SysWOW64 are signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine. Winbindex lists the small forwarders copy as unsigned, so judge that one by its folder and hash.

   Get-AuthenticodeSignature 'C:\path\to\kernel32.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which copy processes really load. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type kernel32.dll and press Search. Every process should show C:\Windows\System32\kernel32.dll, or C:\Windows\SysWOW64\kernel32.dll for 32-bit programs. A loaded kernel32.dll from any other path is a serious warning sign.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with 975 known Microsoft builds. A copy outside the Windows folders that matches is a genuine file someone copied there; one that does not match is not Microsoft's file.
6. Scan before you delete anything. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. Never delete or quarantine the copies in the Windows folders yourself; if they look wrong, repair them with System File Checker.

A match to a Microsoft build proves the file is Microsoft's, but not that it belongs where you found it: a genuine kernel32.dll in Downloads is still a stray copy. A copy that matches nothing and sits outside the Windows folders is not a Windows file, whatever it is called. The genuine copies themselves cannot tell you whether malware is running, because every process loads them.

Warning signs and what they mean

Everyday problems with kernel32.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

kernel32.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 975 Microsoft builds in total are known.

Known versions of kernel32.dll

A public DLL catalogue lists 38 versions of kernel32.dll, from 4.10.0.2222 to 10.0.19041.292, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix kernel32.dll errors on uGetFix

Questions people ask