CmdID / Files

AsrCDDrv.sys

ASRock Setup Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/bd06e043-0f69-4212-be93-d069bf0de848/

1 known sample

1.00.00.0000 built by: WinDDK · its entry

04cc7df4077e36199b04afa39204c8f568f7f66f045e73010fb9b7685324442f

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real AsrCDDrv.sys?

file version info and known copies

ProductASRock Setup utility, ASRock Incorporation

DescriptionASRock Setup Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.