Driver intelligenceVulnerableVerified

6c8a.sys

6c8a.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 54af50e5-c964-485a-9b15-d5411971a425ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

6c8a.sysSample 1 · HVCI FALSE

MD5: 7039952d33cbef5d5b818a42d83b3cd2
SHA1: 9f390c92c2a268e05a0eceb195f396499ff4514a
SHA256: 8fc5300027547e0eb446239c2a2b95016a9cd25816576407c64389ad12676c8a
Imphash: a8633e68c2ad9f3dc83775d8d5b21c5b
Authentihash MD5: 2368d70c7cf869566b9fe49a5e1254ce
Authentihash SHA1: ab9695b3ecf873d4d3cb63ed9fc67410df037b48
Authentihash SHA256: 5a84dcef471a265c712cc488aac278cbbfb29f9188db9a9335c2e870afb7c123
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create 6c8a binPath=C:\windows\temp\6c8a.sys type=kernel && sc.exe start 6c8a

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint