CmdID / Files

dddriver64Dcsa.sys

Dell Diags Universal Device Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/705330b3-5e2c-4c87-ab92-0f01b68b1b2d/

2 known samples

2.0.3.0 · its entry

1907ebc1398f8bf40c76065fd5b10872c3e947c051e62bc9feeb7316651aab0d

2.0.3.0 · its entry

1f46f7a8f414bb1ac9f875799efa4b5f62bd18806c64b17d961007755accb5ab

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real dddriver64Dcsa.sys?

file version info and known copies

ProductDell Diags Universal Device Driver, Dell Inc.

DescriptionDell Diags Universal Device Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.