LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

SANDRA.sys

Description not recorded.

UUID / a7628504-9e35-4e42-91f7-0c0a512549f4ADDED / 2023-05-06AUTHOR / Nasreddine Bencherchali

Known samples 4

0 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SANDRASample 1 · HVCI FALSE
MD5
c842827d4704a5ef53a809463254e1cc
SHA1
09c567b8dd7c7f93884c2e6b71a7149fc0a7a1b5
SHA256
3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75
Imphash
84d45ee8df6f63b5af419d89003a97bc
Authentihash MD5
e4c579f7ebcf89c4f5790a584eb5af4c
Authentihash SHA1
6cec31c2fa78387a8d4d06934ac370033dd24ade
Authentihash SHA256
959860cea7a720811a960e28e0318c470948d96ab3ba3312d20fea0f24bc0979
Machine
AMD64
Version
10.7.1.1 built by: WinDDK
Publisher
SiSoftware
Download vulnerable sampleView on VirusTotal
SANDRASample 2 · HVCI FALSE
MD5
84b17daba8715089542641990c1ea3c2
SHA1
3059bc49e027a79ff61f0147edbc5cd56ad5fc2d
SHA256
496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b
Imphash
4433528b0f664177546dd3e229f0daa5
Authentihash MD5
22eb1c16aae2709fa26bb9da73ab3df8
Authentihash SHA1
deec6cefac2084349127f29ac7ccf26b24458d89
Authentihash SHA256
18dfe852fade6625862cc963922c1f2389a296af96df11eb7b62bbeddd61e18a
Machine
AMD64
Version
10.5.1.1 built by: WinDDK
Publisher
SiSoftware
Download vulnerable sampleView on VirusTotal
SANDRASample 3 · HVCI FALSE
MD5
e36f6f7401ae11e11f69d744703914db
SHA1
dcdc9b2bc8e79d44846086d0d482cb7c589f09b8
SHA256
881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461
Imphash
e2306e26abfd90a5ce4dad0e266b3905
Authentihash MD5
5ef46421c4cda0345e6d732ae4be93d5
Authentihash SHA1
c021fb8f391cdedb6f152a8eb839464c3770bf5d
Authentihash SHA256
9ce44d1643bc4d87e5029a4927613035bbd96b4e45a2400aed987396115791f7
Machine
AMD64
Version
10.3.1.1 built by: WinDDK
Publisher
SiSoftware
Download vulnerable sampleView on VirusTotal
SANDRASample 4 · HVCI FALSE
MD5
1610342659cb8eb4a0361dbc047a2221
SHA1
8d0f33d073720597164f7321603578cd13346d1f
SHA256
b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a
Imphash
8e96d1a56746c6f6f30f1a0963ce2f26
Authentihash MD5
04ef6182073a4cbc8a606a4480093e0c
Authentihash SHA1
3c722e2822e0af72d3f868fffb8e5b884e502254
Authentihash SHA256
68dca726b16c56c70259c8f936ec20adb9ecb8c3cc73985083f41358c83935f4
Machine
I386
Version
10.7.1.1 built by: WinDDK
Publisher
SiSoftware
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create SANDRA binPath=C:\windows\temp\SANDRA type=kernel && sc.exe start SANDRA

Elevate privileges · Privileges: kernel · OS: Windows 10