← Back to driver explorer
Driver intelligenceVulnerableVerified
SmSerl64.sys
A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
SmSerl64.sysSample 1 · HVCI unknown
- MD5
7ae8bca90539ecbde87ac45ba1436be3- SHA1
68ca0b533ec923a2375d88eef60a0dc32bc84589- SHA256
e599200c44eca5eb06475f90f67a58723b30c3c2887bd12ed7c31ff1042382ea- Imphash
21728cd772a10f8a18b2d9bfc8823b2e- Machine
- AMD64
- Version
- SM56 Rel. 6.12.23 built by: WinDDK
- Publisher
- Motorola Inc.
Recorded command
sc.exe create SmSerl64.sys binPath=C:\windows\temp\SmSerl64.sys type=kernel && sc.exe start SmSerl64.sysElevate privileges · Privileges: kernel · OS: Windows 10