CmdID / Files

inpout32.sys

Kernel level port access driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/

5 known samples

1.2 built by: WinDDK · its entry

16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc2495168251

1.2 built by: WinDDK · its entry

7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d

1.2 built by: WinDDK · its entry

945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507

1.2 built by: WinDDK · its entry

b8ded5e10dfc997482ba4377c60e7902e6f755674be51b0e181ae465529fb2f2

1.2 built by: WinDDK · its entry

cfab93885e5129a86d13fd380d010cc8c204429973b776ab1b472d84a767930f

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real inpout32.sys?

file version info and known copies

Productinpout32 Driver Version 1.2, Highresolution Enterprises [www.highrez.co.uk]

DescriptionKernel level port access driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.