← Back to driver explorer
Driver intelligenceVulnerableVerified
AsrDrv107.sys
ASRock AsrDrv107.sys and AsrDrv107n.sys are ASRock IO driver builds listed as KDU providers for ASRock Motherboard Utility versions 3.0.498 and below. The driver family is associated with CVE-2020-15368 and exposes low-level privileged access primitives used by KDU.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
AsrDrv107.sysSample 1 · HVCI unknown
- MD5
894b30abec6e268d1e8b10edc030e8b4- SHA1
b1fad5da173c6a603fffe20e0cb5f0bdca823bd5- SHA256
be131e30464c7be03bd2d16f99ea2b04c106b482cc5c52be659e4c0301206348- Imphash
88e21ed9e717781eaf87209acbdbb567- Authentihash MD5
ba51ac59d2eed380f276a5c656d5fc25- Authentihash SHA1
268073ad0b17e2161c1a2a6c5b1bdebb7b3011b4- Authentihash SHA256
d7b082adddeefc2cc8c48871ca50522121ec4add2796b4e3bdf225fde77e8625- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- ASRock Incorporation
AsrDrv107n.sysSample 2 · HVCI unknown
- MD5
9261f8881611d1b84dfa8b1a54802cf0- SHA1
11d7e0d29ab17292fd43bdd5ccb7da0403e50e52- SHA256
12177d777345f60a579e7bd8f0df95296af6e293e5560ee544fcced99a5db0df- Imphash
3edc8a0f9cf180b3687025e17be537cc- Authentihash MD5
4730c2d0f0ea033d5a82523a132c6ea1- Authentihash SHA1
ca06d9fd91f7b681204b35975d5c069d0dabe276- Authentihash SHA256
31e708f95a0fd64a29333b05185ef3dfbd6b053d766e73ffc4b7ce08286bad24- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- ASRock Incorporation
Recorded command
sc.exe create AsrDrv107 binPath=C:\windows\temp\AsrDrv107.sys type=kernel && sc.exe start AsrDrv107Access low-level kernel and hardware primitives through vulnerable ASRock IO driver builds. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KDU Project / SharpKernel @hfiref0x / @hsheric0210