CmdID / Files

sfdrvx64.sys

SpeedFan x64 Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/

3 known samples

X4.43.04 · its entry

88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af

X2.03.11 · its entry

f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560

X2.01.07 · its entry

965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real sfdrvx64.sys?

file version info and known copies

ProductSpeedFan, Almico Software

DescriptionSpeedFan x64 Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.