CorsairLLAccess64.sys

Corsair LL Access file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/
https://www.loldrivers.io/drivers/ff74f03e-e4ce-4242-bfe3-60601056bb34/

7 known samples

1.0.24.0 · its entry

01e024d3c76fb1b71851ab7761afbee23159d6e8cbf7f5f1d5052efca2f7756d

1.0.22.0 · its entry

6c264246efbfb2db0e5c82e8a4e9ad896872cd306c71af5b7b242fb7b3ff3ab1

1.0.18.0 · its entry

000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b

1.0.18.0 · its entry

a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d

1.0.16.0 · its entry

29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6

1.0.16.0 · its entry

5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36

1.0.15.0 · its entry

f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real CorsairLLAccess64.sys?

file version info and known copies

ProductCorsair LL Access, Corsair Memory, Inc.

DescriptionCorsair LL Access

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names CorsairLLAccess64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.