CmdID / Files

PMAD.sys

Physical Memory Access Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/ec5012bb-789a-436d-be22-b343c331f7c7/

1 known sample

2.1.2.5 · its entry

37784d01f84aa4d60c8738f7a75dac1bf712941fc08ed9f32f3e89d044d9c71f

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real PMAD.sys?

file version info and known copies

ProductPhysical Memory Access Driver, Catalyst Enterprises Inc.

DescriptionPhysical Memory Access Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.