LgCoreTemp.sys
CPU Core Temperature Monitor file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
1.0.0.1 · its entry
93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de01311.0.0.1 · its entry
e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8efFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real LgCoreTemp.sys?
ProductLgCoreTemp, Logitech
DescriptionCPU Core Temperature Monitor
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names LgCoreTemp.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.