AODDriver.sys
AMD OverDrive Service Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
11 known samples
3.2.0 built by: WinDDK · its entry
81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d053.1.0 built by: WinDDK · its entry
3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d3.1.0 built by: WinDDK · its entry
5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac93.1.0 built by: WinDDK · its entry
7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca33d7046a5d41f4010ad5df632577154ed223dac2ab0ca2da57dbf1724db45a57478bcb750017cb6541f3dd0d08a47370f3c92eec998bc3825b5d8e08ee831b7049ae47b6b4d5e1b791b89e0395659d42a29a79c3e6ec52cbfcb9f9cef857a9dd4ace6dded819e87f3686af2006cb415ed75554881a28c54de606975c419751125daa8fa3b5db2e6225a2effea41af95fe7ffc579550c4081c8028ed33bc023b88a982eed9cbc724d50a9ddf4f74ecbcd67b4fdcd9c2bb1795bc88c2d9caf7506ef438a754fd940d145cc5d658ddac666a06871d71652b258946c21efe4b7e517From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real AODDriver.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names AODDriver.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.