Driver intelligenceVulnerableVerified

Mnemosyne.sys

Mnemosyne.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 24cc4f8d-a88d-4b2d-a912-bc773d12a524ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Mnemosyne.sysSample 1 · HVCI FALSE

MD5: 955dc6b491f3270f49a2b2e24970b30d
SHA1: fdb8e429f44e85d9d7a52fc459780d72c29305cb
SHA256: 2ccd04383dc2f1f777b7712c6f8ee6d05afac98d22cad8e96f5172ba9c5c53b0
Imphash: 3e12578d2b7ca27a9a11986fc68a64bd
Authentihash MD5: a86a1cf00d095a051490883b048f4223
Authentihash SHA1: c303af96e3af0e9e70b0f863437859860280c5e0
Authentihash SHA256: 79eac4cc015efad603e984f94067f76408bc929716f1b8dd68106d1066badac9
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Mnemosyne binPath=C:\windows\temp\Mnemosyne.sys type=kernel && sc.exe start Mnemosyne

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint