sfdrvx32.sys
Speed Fan x32 Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7/
https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/
https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/
3 known samples
X4.43.04 · its entry
ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460bX2.03.11 · its entry
0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619eX2.01.07 · its entry
1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cbFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real sfdrvx32.sys?
ProductSpeed Fan, Almico Software
DescriptionSpeed Fan x32 Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names sfdrvx32.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.