CmdID / Files

atidsmxx.sys

ATI DSM Dynamic Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/347d5d79-35e6-4438-885f-57a7c95eeb89/

1 known sample

9.0.000.4 · its entry

1c188041dc8e425a1fff057a3f1433ea306085483337aafeaf24980eb6fc0ac9

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real atidsmxx.sys?

file version info and known copies

ProductATI DSM Dynamic Driver, Advanced Micro Devices, Inc.

DescriptionATI DSM Dynamic Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.