dpmemio.sys
Direct Physical Memory and Port access driver file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
6.0.6000.16386 built by: WinDDK · its entry
cd631c54fe1375e4bdd2f63b58bd106066eeee267fc77b3161ceb023ab5fddda1.0.0.2 built by: WinDDK · its entry
7cf6881e43337c288b1883fafb234146a450ff94388aee395e05e36202c5afbbFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real dpmemio.sys?
ProductDirect Physical Memory and Port access driver, Windows (R) Codename Longhorn DDK provider
DescriptionDirect Physical Memory and Port access driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.