asmmap.sys
Memory mapping Driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
4 known samples
1, 0, 9, 1 · its entry
003326a58256a5bf9912a0b4f6f39295c2909596b33c3837a0c85c7ba7523e141, 0, 9, 1 · its entry
025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc41.1.7.123 built by: WinDDK · its entry
42baccea0fceb60b79f78098163147a8dd1ded24cb2f0dbb93edc07dab66135c1.1.7.123 built by: WinDDK · its entry
5f76c140118b181427969237e364fd70b14fa36533061fd4d8eb2f4751706739From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real asmmap.sys?
ProductATK Generic Function Service, ASUS
DescriptionMemory mapping Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.