KernelBase.dll: genuine Windows core library, or a copy that does not belong?

What KernelBase.dll does, and why malware is interested in it

KernelBase.dll holds the basic functions that Windows programs call to open and write files, reserve memory, start processes and threads, read the registry and report errors. Microsoft split this code out of kernel32.dll and advapi32.dll in Windows 7; programs still call the older libraries, which pass many requests on to KernelBase.dll. Because of that, Windows loads it into every process from the moment the process starts.

The file is often named in crash reports as the faulting module. That is not a sign of infection: KernelBase.dll is where Windows raises the error a program threw, so any crashing program can point at it. The exception code in the report says what really failed.

For malware, the interesting part is not the file but what passes through it. Functions that create files, open processes or read memory sit in KernelBase.dll, so code that hooks them inside a running program can watch, change or hide what that program does. MITRE ATT&CK describes this as API hooking: the malware rewrites the first instructions of a function in the program's memory so that calls jump to its own code first. The file on disk stays exactly as Microsoft signed it, which is why a matching hash proves the file is genuine but not that every process on the PC is clean.

Replacing the file itself is rare and noisy. KernelBase.dll is a protected system file, System File Checker restores it, and a wrong build stops Windows from starting. A copy with this name in another folder is a different matter: it is not loaded by Windows, but it can be a disguise, a leftover of a cracked program or part of a package that uses a Windows name to look harmless.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell the genuine KernelBase.dll from a copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell and Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies. Copies inside C:\Windows\WinSxS and servicing folders are Windows' own stored versions. Any other path deserves a closer look, especially Downloads, Temp, AppData and program folders.

   Get-ChildItem C:\ -Recurse -Filter KernelBase.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field, the version and the size. Right-click the file, Properties, Details. The genuine file says Windows NT BASE API Client DLL, Microsoft Corporation, and a Windows version such as 10.0.26100 or 10.0.19041, at about 3 to 4 MB. A fake can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means the file is not Microsoft's.

   Get-AuthenticodeSignature 'C:\path\to\KernelBase.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which copy programs load. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type kernelbase.dll and press Search. Every process should show the copy in System32, or SysWOW64 for 32-bit programs. A process that loads KernelBase.dll from any other folder is a serious warning sign.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. Windows updates this file almost every month, so a genuine build can be newer than the index; then the signature decides.
6. Scan the memory, not only the file. Because hooks live in memory, run Microsoft Defender's full scan, and the Microsoft Defender Offline scan if something keeps coming back or Defender cannot finish. The offline scan starts outside Windows, where malware that hides by hooking cannot interfere.

A match to a Microsoft build proves the file on disk is Microsoft's. It says nothing about hooks that malware places in a running program's copy of the library in memory, so pair the file checks with a full or offline scan when the PC behaves oddly.

Warning signs and what they mean

Everyday problems with KernelBase.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

kernelbase.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 1300 Microsoft builds in total are known.

Known versions of kernelbase.dll

A public DLL catalogue lists 28 versions of kernelbase.dll, from 6.1.7600.16385 to 10.0.19041.804, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix kernelbase.dll errors on uGetFix

Questions people ask