Driver intelligenceVulnerableVerified

srswdrv.sys

srswdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 5c4142a6-b287-4817-864f-152be08f7c48ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

srswdrv.sysSample 1 · HVCI FALSE

MD5: 4aa226d5b771edc1109c469a76bd38b2
SHA1: 1b03900fe18aee01758379daef96cb5ad66d2690
SHA256: 57414e532a7a10ae7af7fa6294d1d95ad4d9d506882258c5e59d53b4e4f2c91a
Imphash: 582d4ea1add7abb8148deff8402d2e6b
Authentihash MD5: de13493d94dfb0940f0f7d52e87fe559
Authentihash SHA1: 3f177d52830a62cdae02fc8bbe783cb8b4103d3c
Authentihash SHA256: c6852ea86cb52934d04af2e042b32017191d5ba342e3cbcad89c719fa039e15b
Machine: AMD64
Version: 5.03
Publisher: Lenovo

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create srswdrv binPath=C:\windows\temp\srswdrv.sys type=kernel && sc.exe start srswdrv

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint