Driver intelligenceMaliciousVerified

POORTRY.sys

Driver categorized as POORTRY by Mandiant.

UUID / 25d5ebe3-e827-44a4-86fc-898844595c23ADDED / 2023-03-04AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

POORTRY.sysSample 1 · HVCI FALSE

MD5: 7f9309f5e4defec132b622fadbcad511
SHA1: a3ed5cbfbc17b58243289f3cf575bf04be49591d
SHA256: 6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421
Imphash: beceab354c66949088c9e5ed1f1ff2a4
Authentihash MD5: 103f3c1ce174dff5dfc79a428d4bf385
Authentihash SHA1: b4d007b0c6ae6b4cfd96aab617f239cd8ebc8afb
Authentihash SHA256: 45b9eee68266d1128bc252087f4a8ae18dbb0e0b6317e28bc248b25ca2431a56
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

sc.exe create POORTRY.sys binPath=C:\windows\temp\POORTRY.sys type=kernel && sc.exe start POORTRY.sys

Elevate privileges · Privileges: kernel · OS: Windows 10