procexp.Sys
Process Explorer file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
29 known samples
Show the 29 samples’ SHA-256 hashes
16.43 · its entry
440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c16.42 · its entry
16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c116.42 · its entry
98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb16.41 · its entry
7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf16.32 · its entry
075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e8516.32 · its entry
cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc16.27 · its entry
9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e415.00 · its entry
3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a15.00 · its entry
3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc15.00 · its entry
46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f715.00 · its entry
59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d87915.00 · its entry
6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e15.00 · its entry
6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e715.00 · its entry
77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c15.00 · its entry
88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc15.00 · its entry
89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf715.00 · its entry
9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc215.00 · its entry
c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa15.00 · its entry
d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db3347615.00 · its entry
e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af0615.00 · its entry
e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd15.00 · its entry
f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c9347812.00 · its entry
1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e12.00 · its entry
51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b511.40 · its entry
3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa11.40 · its entry
86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed67511.30 · its entry
30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb11.01 · its entry
bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c9.30 · its entry
bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668fFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real procexp.Sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names procexp.Sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.