CP2X72C.SYS
GPC-2X72C I/O Module Device Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
5 known samples
3.30.33.0 · its entry
05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d98811344616863.30.33.0 · its entry
4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f3.02.30.0 · its entry
63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e3.02.30.0 · its entry
9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce911.61-20 · its entry
11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real CP2X72C.SYS?
ProductGPC-2X72C DIO-BM(PCI/C-PCI), Interface Corporation
DescriptionGPC-2X72C I/O Module Device Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names CP2X72C.SYS in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.