Driver intelligenceVulnerableVerified

SysFile_X64.sys

SysFile_X64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 1ce0aa79-8719-447c-908b-75547f2ccc98ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SysFile_X64.sysSample 1 · HVCI FALSE

MD5: 9ddff9a4ec7e38e4e05fd16e2b1037ff
SHA1: b980dec0bdf7b0925240d002626e56876afeec72
SHA256: 5b204e0a24b5ea67e79329a8c4eb0513cd52a0e7407b99530323fff4c5b59e34
Imphash: f7455c9aef32ded0c517c29637a75058
Authentihash MD5: 79ce391f46d8dcd51232db3c3e53241a
Authentihash SHA1: 96c3b210c05511481b8490535828d4ef2ee73a09
Authentihash SHA256: fdd8e305c7aaaf1c8ef047373db48069126a6f3ec9dc3c6b2dc30fc621c84b03
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create SysFile_X64 binPath=C:\windows\temp\SysFile_X64.sys type=kernel && sc.exe start SysFile_X64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint