Driver intelligenceVulnerableVerified

fastdumpx64.sys

fastdumpx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 619953be-2115-4da2-bb59-603fcf93a3d2ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

fastdumpx64.sysSample 1 · HVCI FALSE

MD5: 016c1d3cc193732736eeaeb3094154f2
SHA1: 624fc5ef63f1c58ef6c0202080a08be12aa441df
SHA256: 9cb90643674a941bca2ff0823618e4790a737b9bdcfe882b3af6926591b84d80
Imphash: c02969a03cdf95399c373efc0b2b9705
Authentihash MD5: 6f2eb3bb8a7c0f352e7eb07b7cbc9354
Authentihash SHA1: be48eedeb189bc1a31232e700cbe2f2e49da9151
Authentihash SHA256: 32157838040ddbd0f7b5ccaf597f6e338b9e00cdb2705e8719149d1ad8249a88
Machine: AMD64
Version: 2.3.0.97
Publisher: CounterTack

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create fastdumpx64 binPath=C:\windows\temp\fastdumpx64.sys type=kernel && sc.exe start fastdumpx64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint