Driver intelligenceVulnerableVerified

Lallamon.sys

Lallamon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 50de2fce-d9b5-4007-abef-22560e4e93b2ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Lallamon.sysSample 1 · HVCI TRUE

MD5: 0f5f7fbde32b64ae67dbd74d7524f12b
SHA1: d93b2a7e4533303b615d5f9627d631e37235ad3f
SHA256: d9dc2860ab791755a535786dcc559db186ba19ba99ea75266844f249a1e138a0
Imphash: de9cf1d3b5a2bcc1115188dbeecacdeb
Authentihash MD5: 840d33d969e06b88108c21a041d96c98
Authentihash SHA1: 1fb9079886960a77ad476b30d09e7a23862d708c
Authentihash SHA256: f16feb4a57df08a5184f5c1d01e724546090a316b6e268c098440953b7fead55
Machine: AMD64
Version: 1.1.0000.00
Publisher: Lallasoft

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Lallamon binPath=C:\windows\temp\Lallamon.sys type=kernel && sc.exe start Lallamon

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint