CmdID

CmdID / Files

CorMem.sys

Sapera Memory Manager file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/a7c3e2d1-8f4b-4e6a-b5d9-3c1f0e7a9b82/

1 known sample

9.00 · its entry

40c855d20d497823716a08a443dc85846233226985ee653770bc3b245cf2ed0f

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real CorMem.sys?

file version info and known copies
ProductSapera LT, Teledyne Digital Imaging Inc.
DescriptionSapera Memory Manager

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.