Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dogshit.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dogshit.dll
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target dogshit.dll
- Size 1.6MB
- Sample260523-246dcsby5r
- SHA256 77bbc882f1ea676b7b452a2d741bdac581c90a97864cb3b959a4e2a250d3970b
- MD5 3860e09be2c495eb7e96f22f19717703
- SHA1 ebadf215c480c1a0cc992b5b68cfb0be60f2dc61
- SHA512 0dfb42632d954a9a8cf9a000330347418ad43ce7a6d5999fa6ebc1e80941403aa123d2695fdda42d7c924bca65c14e5226f7f8cb36dbbbb99b97691d7c79201f
- SSDEEP 24576:GL6V/SIRU2ZH9RluTHsFj4SqrgwaZsb+X6UFIoZunoVb:GAzRUIH9RYDsJ4Ewaeb+X6O
- TLSH T10B752A17E6A295ECC57BD0748767A732F970B85E40347E2E2B94DB311F20E60972EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2480 rundll32.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2480 rundll32.exe 2480 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dogshit.dll,#11⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Badlisted process makes network request
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2480