amifldrv64.sys
AMI Generic Utility Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
22 known samples
Show the 22 samples’ SHA-256 hashes
20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb26ba58c9af9c8a7aebf222f491f786daa0626be44d34f170fea3623d92828e632f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae3482f671cb1b6414e43ab2c9bccc94c1fba67ceac6e9831249f18f31ad68880c36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba3972159a58fd04da06f648c3828648cf394d3eb6af89538166cae8e6184c3eb63cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc13442579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f005e238d351e16d4909ca394f1db0326a60d33c9ac7b4d78aefcf17a6d9cc72be95f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c96c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a7c942801884999057aabdc01707570371afdb077979ee2f318c05276123b78e7990165725debccea7ca15aa4ed7a0e3a2a25b4a72cb309a27c899bd0e4b5148fb95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6ff06fdfe50ebc8d1d2daf5811b66288563f26a09a2ec9c2a21e2a71ff19756062fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real amifldrv64.sys?
ProductWindows (R) Win 7 DDK driver, Windows (R) Win 7 DDK provider
DescriptionAMI Generic Utility Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names amifldrv64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.