Driver intelligenceVulnerableVerified

SysInfoX64.sys

SysInfoX64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 1dd9bcd1-0090-4561-bfc4-481c3d139c81ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SysInfoX64.sysSample 1 · HVCI FALSE

MD5: 44fa80e2e754e679bdefccc8eb3d7a21
SHA1: fd1db5794918d580e3ad0d71f4a559005de90f22
SHA256: 52c5ffd62eae04b890e0f4c96b84a3305e9b6571975c4352131cfc3d1b73a024
Imphash: 31590ca2264abb5df63ef59df282330a
Authentihash MD5: bce2164382ded6dcd1521a93246f8706
Authentihash SHA1: a4983d9008e396b0f57758da233355127893c1b5
Authentihash SHA256: 807e54ac1703e3342373a7967d3f862dd5ee1c00dbabba49d8996677f779c9cd
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create SysInfoX64 binPath=C:\windows\temp\SysInfoX64.sys type=kernel && sc.exe start SysInfoX64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint