kEvP64.sys
PowerTool file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/
9 known samples
1.0.1.0 built by: WinDDK · its entry
09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a1841.0.1.0 built by: WinDDK · its entry
1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c1.0.1.0 built by: WinDDK · its entry
2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d1.0.1.0 built by: WinDDK · its entry
7462b7ae48ae9469474222d4df2f0c4f72cdef7f3a69a524d4fccc5ed0fd343f1.0.1.0 built by: WinDDK · its entry
7c0f77d103015fc29379ba75d133dc3450d557b0ba1f7495c6b43447abdae2301.0.1.0 built by: WinDDK · its entry
8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f1.0.1.0 built by: WinDDK · its entry
97363f377aaf3c01641ac04a15714acbec978afb1219ac8f22c7e5df7f2b2d561.0.1.0 built by: WinDDK · its entry
d9500af86bf129d06b47bcfbc4b23fcc724cfbd2af58b03cdb13b26f8f50d65e1.0.1.0 built by: WinDDK · its entry
e61004335dfe7349f2b2252baa1e111fb47c0f2d6c78a060502b6fcc92f801e4From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real kEvP64.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names kEvP64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.