CmdID / Files

DDDriver.sys

DDDriver.sys file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/6f6aedb9-aeaf-4c13-9d6d-37f062728c38/

1 known sample

1.1.0.0 · its entry

51562209e16a1c0247d73d7bfc8827ae4a2e57af11350379a8fba1ec44e56e54

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real DDDriver.sys?

file version info and known copies

ProductDell Diags Device Driver, Dell Computer Corporation

DescriptionDDDriver.sys

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.