dot3cfg.dll
802.3 Netsh Helper file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real dot3cfg.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Description802.3 Netsh Helper
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dot3cfg.dll · signed by Microsoft Windows
1e2f7456463f06655e5fc63aad8d1bc964afe3f35985459e09c0642e57a1fc0d10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dot3cfg.dll · signed by Microsoft Windows
3328ac5655b79a5f015c21d4ded3c1f40e383fbb0463f39768213270c5ddfe7cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names dot3cfg.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.