winmm.dll: the genuine Windows Multimedia library, or a copy someone planted?

What winmm.dll does, and why other copies of it turn up

winmm.dll is the library of the Windows Multimedia API, the sound and timing interface Windows has carried since the 1990s. Programs call it to play and record wave audio, to send MIDI notes to a synthesizer, to play a system sound with PlaySound, to control media devices with MCI commands, to read simple joysticks and to use the multimedia timers. Games in particular call timeBeginPeriod and timeGetTime to keep frame timing steady. Newer audio interfaces exist, but so much software still uses these functions that Windows 10 and Windows 11 load winmm.dll into a large share of running programs.

Because the file is so common and is not one of the libraries Windows always loads from System32, it is also a favourite name for proxy DLLs. A program looks for winmm.dll in its own folder before the Windows folder. Put a library with that name and the same functions there, and the program loads it, runs whatever it contains, and the proxy passes the real calls on to Windows' copy.

Game add-ons do this openly: plugin loaders that start .asi files, wrappers that replace an old game's CD audio tracks with music files, frame rate and timer fixes. Cracked game releases also ship files under this name. Attackers do the same thing with trusted programs: they copy a signed Windows or vendor program into a folder of their choice and place their own winmm.dll beside it, so their code runs under a name and a signature that security tools trust.

So the useful question is where the file is and who signed it. The copies in the Windows folders belong to Microsoft. Any other winmm.dll belongs to whoever put it there.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' winmm.dll from a planted copy

A DLL has no entry of its own in Task Manager, so check it by its folder, its properties, PowerShell and Process Explorer.

1. List every copy on the drive. Run the command below in PowerShell. Paths under C:\Windows\System32, C:\Windows\SysWOW64 and C:\Windows\System32\forwarders are Windows' own. A copy in a game folder is expected only if you added a mod there. A copy beside a Windows program that was copied out of System32, or in a folder whose name only looks like a Windows path, is a strong warning sign.

   Get-ChildItem C:\ -Recurse -Filter winmm.dll -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Look at the files beside it. A planted winmm.dll rarely sits alone. If the same folder holds a Windows program such as winsat.exe, mspaint.exe or osk.exe, or a copy of a vendor program, outside its normal install folder, the pair was put there on purpose. Genuine Windows programs run from System32, not from AppData, Temp or Public folders.
3. Check the signature. Windows' copy is signed by Microsoft, usually through a catalog file, so the Properties window may not show a Digital Signatures tab. PowerShell reads both kinds of signature. Valid with a Microsoft signer means genuine. A patched copy of Microsoft's own file shows HashMismatch or NotSigned, because any change to the file breaks the signature.

   Get-AuthenticodeSignature 'C:\path\to\winmm.dll' | Format-List Status, SignatureType, SignerCertificate

4. See which copy a program has loaded. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type winmm.dll and search. Expect many results, since many programs load it. Read the path column: anything outside the Windows folders shows which program has loaded a third-party copy.
5. Compare the SHA-256 with Microsoft's builds. Use the checker on this page. It computes the hash in your browser and looks it up among 421 Microsoft builds. A match proves the file is Microsoft's, even if it was copied somewhere it does not belong. A file that was patched, even by a few bytes, matches nothing.
6. Scan with Microsoft Defender. Run a full scan, and the offline scan if a detection returns after removal. Weigh a detection on a game folder copy together with where the mod came from, because legitimate loaders are often flagged for the way they work.

A matching hash and a valid Microsoft signature settle that a file is Microsoft's. A file that matches nothing is not proven malicious: most game folder copies are add-ons that do what their authors describe. What decides is whether you installed that add-on, where you got it, and whether the file is still the one its author released.

Warning signs and what they mean

How attackers have used the name winmm.dll

Two published reports describe a malicious winmm.dll in real attacks. In both, the attackers relied on a trusted program loading the file from its own folder; the copy in System32 was never touched.

MITRE ATT&CK lists both as Hijack Execution Flow (T1574). Neither changed Windows' own winmm.dll, so a healthy System32 copy proves little. Look for a winmm.dll that sits beside a program outside its normal folder, and for a Microsoft-looking copy whose signature no longer validates.

Programs that have been made to load a fake winmm.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted winmm.dll. Usually the attacker copies the program into another folder and puts a fake winmm.dll next to it: Windows looks in the program's own folder first. A winmm.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine winmm.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine winmm.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for winmm.dll, 6 public reports.

Everyday problems with winmm.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

winmm.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 421 Microsoft builds in total are known.

Known versions of winmm.dll

A public DLL catalogue lists 16 versions of winmm.dll, from 4.3.0.1998 to 10.0.18362.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix winmm.dll errors on uGetFix

Questions people ask