WinFlash64.sys

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/7b893f79-b5b0-4373-9d29-c53a21fe6fc3/
https://www.loldrivers.io/drivers/902249eb-87cb-4c01-8da7-17675d743cd7/

4 known samples

its entry

316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d

its entry

677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf

its entry

8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d

its entry

8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

What detects it

Sigma

Sigma names WinFlash64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.