CmdID

CmdID / Files

drvinst.exe

Driver Installation Module file version info

Program on Windows 9 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real drvinst.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDriver Installation Module

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\drvinst.exe · signed by Microsoft Windows

0f013c349fce684c14a91d380d6fb936bc2706ab3fbaac2886097c12bee6bcde

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\drvinst.exe · signed by Microsoft Windows

e14f9dd7d33f19f7ece9bd23b239043ccc41cff0bd2ca0cc5b15ef66dd82c7d8

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\drvinst.exe · signed by Microsoft Windows

4f26a96f6533a909c74a369e98d8909d966a1c3b5fa8e1f775e9b4777150a08c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\drvinst.exe · signed by Microsoft Windows

fa4be1f424ec5b2d68c54652c3ed3e9c0189f5b4e1be532b07807e2817b03f2d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\drvinst.exe · signed by Microsoft Windows

8aa128b9019439d525442bcac7849def30976ebc9ee72965ac42260d18d190b3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\drvinst.exe · signed by Microsoft Windows

d0fe99477fe70549d0c240185b77fd9db4124a0b6bf413248986eff16f3b2a85

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\drvinst.exe · signed by Microsoft Windows

c196086017725e8724dab1dfdfaba9f4b7cfacd47a885bcc81984f8bc78d9f75

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\drvinst.exe · not signed

0989c392bc0b8d3fd4d1267e59b2e11bcb31cb8a5f4c8b2bf4563ca2ce4e2653

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\drvinst.exe · not signed

65488a3c53a3c1f5569beab9cd3fe1683040dc9595bf698a1962e02694f4ee8c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name drvinst.exe
lowPotential Suspicious Execution From GUID Like Folder NamesNasreddine Bencherchali (Nextron Systems)

Sigma names drvinst.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.