vmdrv.sys
Voicemod Virtual Audio Device (WDM) file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2ea12acc-95b6-4f91-afb7-8ded7a2fe9d9/
https://www.loldrivers.io/drivers/fdf4f85b-47f4-4c98-a0d5-a6583463f565/
https://www.loldrivers.io/drivers/fdf4f85b-47f4-4c98-a0d5-a6583463f565/
3 known samples
10.0.10011.16384 · its entry
32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d135110.0.10011.16384 · its entry
5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c10392110.0.10011.16384 · its entry
d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real vmdrv.sys?
ProductWindows (R) Win 7 DDK driver, Windows (R) Win 7 DDK provider
DescriptionVoicemod Virtual Audio Device (WDM)
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names vmdrv.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.