AsrDrv.sys

ASRock IO Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/0258df5c-c3c1-4ed5-ba8f-846d91526ffe/
https://www.loldrivers.io/drivers/213676bb-ffb9-4d0d-a442-8cefee63acc1/
https://www.loldrivers.io/drivers/2d3178da-ea76-4f36-93f4-d76bf846c240/

14 known samples

Show the 14 samples’ SHA-256 hashes

1.00.00.0000 built by: WinDDK · its entry

12177d777345f60a579e7bd8f0df95296af6e293e5560ee544fcced99a5db0df

1.00.00.0000 built by: WinDDK · its entry

14c5576eda5a28d476a93c9cdb91236f18573dbd0578ac2bb183dfd115f4a166

1.00.00.0000 built by: WinDDK · its entry

2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d

1.00.00.0000 built by: WinDDK · its entry

3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838

1.00.00.0000 built by: WinDDK · its entry

4bf974f5d3489638a48ee508b4a8cfa0f0262909778ccdd2e871172b71654d89

1.00.00.0000 built by: WinDDK · its entry

4d03a01257e156a3a018230059052791c3cde556e5cec7a4dd2f55f65c06e146

1.00.00.0000 built by: WinDDK · its entry

53bb076e81f6104f41bc284eedae36bd99b53e42719573fa5960932720ebc854

1.00.00.0000 built by: WinDDK · its entry

6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7

1.00.00.0000 built by: WinDDK · its entry

950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9

1.00.00.0000 built by: WinDDK · its entry

a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc

1.00.00.0000 built by: WinDDK · its entry

be131e30464c7be03bd2d16f99ea2b04c106b482cc5c52be659e4c0301206348

1.00.00.0000 built by: WinDDK · its entry

d20d8bf80017e98b6dfc9f6c3960271fa792a908758bef49a390e2692a2a4341

1.00.00.0000 built by: WinDDK · its entry

ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c

1.00.00.0000 built by: WinDDK · its entry

f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real AsrDrv.sys?

file version info and known copies

ProductASRock IO Driver, ASRock Incorporation

DescriptionASRock IO Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.