GameDriverX64.sys
GameDriverX64 file version info
Driver on Windows LOLDrivers vulnerable driver
A known vulnerable driver
T1068Exploitation for Privilege Escalation
8 known samples
7.23.11.15 · its entry
e55bfbb979143c6d1bc97129c9b5663639b895f1db605cef578b7f06633c08f67.23.11.15 · its entry
f90cab0c3b8159162be3103fcca5bafc27fbf4ec24620900acedaf84b7c0cf307.23.04.07 · its entry
9d396b83647f5233cd93f47caa05e0a0d0dd5dd2f17ba2b0ae5cd1afc0afa69d7.23.04.07 · its entry
9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e7.23.04.07 · its entry
b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d9673837.23.04.07 · its entry
c0db95a62e50f3a2c757ac264534ef17340bf8b8aa94b98fcb7663c493b2d5697.23.04.07 · its entry
ca22e593362a8fa4f728e83f6861f983373f61480d0384e26ed149e507706d6a7.23.04.07 · its entry
fd08ac95226585436c03b01745c608035bfb15a3a832135589a049cb243cefd9From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real GameDriverX64.sys?
ProductGameDriverX64, GameDriver
DescriptionGameDriverX64
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.