Driver intelligenceVulnerableVerified

ipctype.sys

ipctype.sys is a kernel driver from Digital Electronics Corporation that exposes physical memory read/write via MmMapIoSpace. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.

UUID / 509edc55-1881-4fac-8640-b9c516396505ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ipctype.sysSample 1 · HVCI FALSE

MD5: c8f6cd1c989f364f126e6855f1178704
SHA1: 96611a3d59ea7df9453e194fb7c19d0f944bcefc
SHA256: 8e2acce10d704c8b511c8b6211a2be5d8e4ade91ebcbda2ac10018e4c0ae99fb
Imphash: c418dc93b4a3c0a3e13a158f6c2fccd0
Authentihash MD5: f41029188382165844562f7051585447
Authentihash SHA1: 5fe6c6cde2dc32666efc70a4008d9f987ddf4a63
Authentihash SHA256: 073ea5ba764b889b611816a73efab36882b5158641084b7431799b62d0ecc45d
Machine: AMD64
Version: 1.0.2.0
Publisher: Digital Electronics Corporation

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create ipctype binPath=C:\windows\temp\ipctype.sys type=kernel && sc.exe start ipctype

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint