CmdID / Files

ADRMDRVSYS.sys

ADLINK Resource Manager Kenerl Service. file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/48aeea9b-7812-4b25-9835-baaebe7dc551/

6 known samples

1.12.802.2022 · its entry

57afe716c49b1a141351b4c24f70d71a688c5ac6d95da8fff348d7f184851a4d

1.12.802.2022 · its entry

806b9f9967e26bee69843f71a7b76305386ceb231fd57549eabeb6b1652ee07e

1.12.802.2022 · its entry

9822ecd5b19022c6db17a0c2bf4a26c00216b456a834371e11ba20323efa7262

1.12.802.2022 · its entry

a1f79a2e1441970bb3e7c838f8c14a8f3d39a46b0ff9648614e922ac475c743d

1.12.802.2022 · its entry

edac730a75ed453bdcdfb7ca1dd19cf1e269e9ca59295efb15ca0071c96ed2f5

1.12.802.2022 · its entry

fa59c670b2282d870dd4c9920e56419ddfd8f5ab15b24e1b8708aa841439cc91

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ADRMDRVSYS.sys?

file version info and known copies

ProductADLINK Resource Manager Kenerl Service., ADLINK Technology, Inc.

DescriptionADLINK Resource Manager Kenerl Service.

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.