Driver intelligenceVulnerableVerified

DNDrv.sys

DNDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 4e7563f0-0d77-43e9-b765-a509ba121818ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

DNDrv.sysSample 1 · HVCI TRUE

MD5: d31c9e4b1aa80d922bfb10b0c780fe2c
SHA1: 64c6c1203d0300175e7012505d1655354c84a978
SHA256: e786f64dab69f2ae1e399044f59dc4b8efc7c291f77ca7f5df4394fe00edf62b
Imphash: 912cb4e9ebbc30aed14dc1984dc75d01
Authentihash MD5: d423cb65c0e70be48c172f1926c52972
Authentihash SHA1: 92435117ec51d530ce7e272601fc00c1b6acfc64
Authentihash SHA256: fe72b01f65bf9e418d6c5020818878ee738163825f9d07bee79d371602edca97
Machine: AMD64
Version: 4.3.12.93733
Publisher: Oracle Corporation

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create DNDrv binPath=C:\windows\temp\DNDrv.sys type=kernel && sc.exe start DNDrv

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint