ext-ms-win-gpsvc-grouppolicy-l1-1-0[.]dll | Triage

Sharing

General

Target

ext-ms-win-gpsvc-grouppolicy-l1-1-0.dll
Size

3KB
MD5

dd200cdaad1071f03c3c3e88a106d652
SHA1

a390fc78e0b6789ca47c4fb3b5fdc5bd8fe1e071
SHA256

1905691cf62990a0d3461a314f0c9de0388b034a8d381ce28cb548ef1598cffd
SHA512

5be1144cb54396c43143d1aa9fc46b75a090f9e37a505b2e74802e18f264000c41125a9bc21084d76a5043d117cf592e79a55e293e91fc845803ffd617956913

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ext-ms-win-gpsvc-grouppolicy-l1-1-0.dll

Files

ext-ms-win-gpsvc-grouppolicy-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EXT-MS-Win-GpSvc-GroupPolicy-L1-1-0.pdb

Exports

Exports

ProcessGroupPolicyCompletedExInternal
ProcessGroupPolicyCompletedInternal
RsopAccessCheckByTypeInternal
RsopFileAccessCheckInternal
RsopResetPolicySettingStatusInternal
RsopSetPolicySettingStatusInternal

Sections

.text
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ