CmdID / Files

Amd_RPMC_BiosToolCommonDriver.sys

the AMD driver to access CPU registers file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/8dbd8d1c-aa4a-418c-9bbe-0730d37d9bb5/

1 known sample

1.0.1.72 · its entry

4e913a99b38abea038202c95c6bc5d8d866a6e2869101a14a05079235346d9a1

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real Amd_RPMC_BiosToolCommonDriver.sys?

file version info and known copies

ProductAMD Field Fusing, Advanced Micro Devices

Descriptionthe AMD driver to access CPU registers

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.