zam64.sys
ZAM file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
10 known samples
3.0.0.000 · its entry
7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc212.11.1.510 · its entry
d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0078e7fb479ad6f0734682d41a17d41518de35bf4f6c5c212643b7d37e641041e2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff13c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a9176614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2ade8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1ce428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93fFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real zam64.sys?
ProductZAM, Zemana Ltd.
DescriptionZAM
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names zam64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.