← Back to driver explorer
Driver intelligenceVulnerableVerified
1109.sys
1109.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
1109.sysSample 1 · HVCI FALSE
- MD5
41c580714dd28bda7da36dc5dc660710- SHA1
9b4052df235ba8e17874c6b1c57130d619f87432- SHA256
f154167b4b92851f478b3c3f88423cd719e3139bac5da07f33dd7929796c96f5- Imphash
4967091397a11c6325fd38bc55575f63- Authentihash MD5
29d54ac52cd8ce43f8d54fd9e6bc894e- Authentihash SHA1
79192e06ccf4edb3928b063c978a751000e35d2a- Authentihash SHA256
aca825f3eb50624c3ab6edc84166ba7e432b503baf438485002311feddce35ae- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create 1109 binPath=C:\windows\temp\1109.sys type=kernel && sc.exe start 1109Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @rainbowdynamix, @DbgPrint