RadHwMgr.sys
Radiant Hardware Manager for P15xx Platform file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
6 known samples
9.9.0.1 built by: WinDDK · its entry
7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f3.1.0.22 built by: WinDDK · its entry
00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c2.33.0.0 built by: WinDDK · its entry
7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc2.20.0.7 built by: WinDDK · its entry
0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a02.20.0.7 built by: WinDDK · its entry
903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b0.0.0.2 Dev built by: WinDDK · its entry
df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real RadHwMgr.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names RadHwMgr.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.