ext-ms-win-kernel32-elevation-l1-1-0[.]dll | Triage

Sharing

General

Target

ext-ms-win-kernel32-elevation-l1-1-0.dll
Size

3KB
MD5

cba5e2ed6c8dd0366b0025a977b24286
SHA1

15f7297957893fc7ecab65fb1c12ac797c263edd
SHA256

1f132de9a9306a03dbe932b8da9b5a5875de2e49f97fc09028ef6613ceafb4e8
SHA512

09796f02ef5e7b8efdf7709ff86becf596157a8f1452b2404701062ee4d6be9a0b1e3a13cf3787ee35665071ff0182e9fc87ebe8b3eadb55252b019e72644bf1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ext-ms-win-kernel32-elevation-l1-1-0.dll

Files

ext-ms-win-kernel32-elevation-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ext-ms-win-kernel32-elevation-l1-1-0.pdb

Exports

Exports

CheckElevationEnabled

Sections

.text
Size: 512B - Virtual size: 273B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ