← Back to driver explorer
Driver intelligenceVulnerableVerified
BSMEM64_W10.sys
Biostar BSMEM64_W10 exposes direct physical-memory and port/PCI access through \Device\BSMEM. IOCTLs 0x226044 and 0x226084 map caller-selected physical addresses with MmMapIoSpace and copy data from or to the mapped region, providing arbitrary physical-memory read and write primitives.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
BSMEM64_W10.sysSample 1 · HVCI FALSE
- MD5
c6e5e575fa7565c6a376773466bbfd8b- SHA1
ae4a9ad473432f2c6c3d31c10db4c45c20a4f592- SHA256
bae39da5cf6f4d8e7d34b903a1a78f5621738ef670165e7c47809f12594b0473- Imphash
ca6932171936fb627b485566416e9cae- Authentihash MD5
0242c2d2634fdf0fad795bf44c8e2e5f- Authentihash SHA1
dae0a519563318da6018e7cd23261ee5b13dce4a- Authentihash SHA256
cc11358e14e140a1aec4e22531cc59636b23fcce4e2efcfa505895b40468a9da- Machine
- AMD64
- Version
- 10, 0, 1806, 2200
- Publisher
- BIOSTAR Group
Recorded command
sc.exe create BSMEM64_W10 binPath=C:\windows\temp\BSMEM64_W10.sys type=kernel && sc.exe start BSMEM64_W10Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: fluffycats31 @fluffycats31