DcProtect.sys
DcProtect Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
8 known samples
1.2.0.0 · its entry
1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f31.2.0.0 · its entry
3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb1.2.0.0 · its entry
55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae031.2.0.0 · its entry
9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c81080665041.2.0.0 · its entry
b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd711.2.0.0 · its entry
c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f36331.2.0.0 · its entry
f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb61.2.0.0 · its entry
ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real DcProtect.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names DcProtect.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.