CmdID / Files

DNDrv.sys

VirtualBox Support Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/4e7563f0-0d77-43e9-b765-a509ba121818/

1 known sample

4.3.12.93733 · its entry

e786f64dab69f2ae1e399044f59dc4b8efc7c291f77ca7f5df4394fe00edf62b

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real DNDrv.sys?

file version info and known copies

ProductOracle VM VirtualBox, Oracle Corporation

DescriptionVirtualBox Support Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.