CmdID / Files

srswdrv.sys

SRSETUPWIN Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/5c4142a6-b287-4817-864f-152be08f7c48/

1 known sample

5.03 · its entry

57414e532a7a10ae7af7fa6294d1d95ad4d9d506882258c5e59d53b4e4f2c91a

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real srswdrv.sys?

file version info and known copies

ProductSRSETUPWIN, Lenovo

DescriptionSRSETUPWIN Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.