← Back to driver explorer
Driver intelligenceVulnerableVerified
ProcessCtr.sys
EsafeNet ProcessCtr / ProcessCtrl64.sys creates a device object reachable by local callers and exposes process-control IOCTL paths. Public research documents a vulnerable process-termination path that can allow privileged process termination or denial of service when user-supplied context/handle material is accepted without adequate authorization checks.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
ProcessCtr.sysSample 1 · HVCI unknown
- MD5
5ee52684ee22f3ad730b6af7e327d82b- SHA1
72ffc3e2afc384657bc1559eb69b4651e24d57d6- SHA256
d64eeb940daffdc8327fb18b160c20e539088cf8407813655f59efa9fdf0022e- Imphash
54560b58b671978b0335b8f1671e3b38- Authentihash MD5
94c40431fd22ca69b9456592881db927- Authentihash SHA1
981b6e6a1e0a7a67ee1420e7ca4be96a6bfa9e7a- Authentihash SHA256
03720e3f26c055778017b6dac3dbb68dda97d5ca730f8c354a829ac5cc4ec6c9- Machine
- AMD64
- Version
- 1.0.1.2
- Publisher
- 北京亿赛通科技发展有限责任公司
Recorded command
sc.exe create ProcessCtr binPath=C:\windows\temp\ProcessCtr.sys type=kernel && sc.exe start ProcessCtrTerminate arbitrary processes from kernel mode, including protected security processes, through an unauthenticated IOCTL handler. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Element2023H