SANDRA.sys
Sandra Device Driver (Win64 x64)(Unicode) file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/
9 known samples
15.18.1.1 built by: WinDDK · its entry
0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f50215.18.1.1 built by: WinDDK · its entry
cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f42718315.18.1.1 built by: WinDDK · its entry
d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c310.11.1.1 built by: WinDDK · its entry
1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b10.7.1.1 built by: WinDDK · its entry
3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad7510.7.1.1 built by: WinDDK · its entry
b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a10.5.1.1 built by: WinDDK · its entry
496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b10.3.1.1 built by: WinDDK · its entry
881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a385546110.2.1.1 built by: WinDDK · its entry
1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real SANDRA.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names SANDRA.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.