How to Troubleshoot Procmon v3.32 Driver Failures on 64-bit Windows 7

Summary

During a breach investigation, Procmon v3.32 could not load its driver on a 64-bit Windows 7 host. The team traced the certificate-validation problem to missing SHA-2 signing support and resolved it by installing KB3033929.

Key points

Procmon v3.32 failed to load its driver on a 64-bit Windows 7 host, although the same version had worked on a 32-bit host.
Windows Event Logs indicated a code-integrity issue with the driver; the driver file was not present in the expected directory after the failed load.
The team extracted the 64-bit driver from Procmon’s executable resources using Resource Hacker, then used Sigcheck to inspect its signature.
Testing on a Windows 7 SP1 virtual machine reproduced the certificate-validation problem.
Installing Microsoft update KB3033929 restored the driver’s certification-path validation and resolved the loading issue.

Article Details

Topic: Troubleshooting a Process Monitor v3.32 driver-signature validation failure on 64-bit Windows 7

Vendors

MicrosoftSince Windows Vista/Server 2008, Microsoft added Driver Signing Enforcement to their 64-bit operating systems to combat the surge of malicious drivers (rootkits). This makes it (slightly) harder for attackers to

Products

Process MonitorProcess Monitor (Procmon) is one of most popular SysInternals utilities which provides users a simple interface to audit process, file, and network activity in ridiculously granular detail.Sysinternals Suitesoftware errors, analyzing malware samples, or discovering security misconfigurations, the Sysinternals Suite can likely solve your problem. For many IT and Security professionals, this collection of Windows Windows 7Unfortunately, Procmon v3.32 was unable to load its driver on the 64-bit Windows 7 host we were analyzing.

Tools

Resource HackerWe chose the quickest path to victory and went with Resource Hacker.SigcheckTo validate the digital signature of our driver, we used SysInternals Sigcheck.