← Back to driver explorer
Driver intelligenceVulnerableVerified
AsrDrv106.sys
ASRock AsrDrv106 drivers expose physical-memory mapping, contiguous memory allocation, and port-I/O primitives through user-controlled IOCTL handlers, enabling privileged manipulation of kernel memory.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
AsrDrv106.sysSample 1 · HVCI FALSE
- MD5
12908c285b9d68ee1f39186110df0f1e- SHA1
b0032b8d8e6f4bd19a31619ce38d8e010f29a816- SHA256
3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838- Imphash
88e21ed9e717781eaf87209acbdbb567- Authentihash MD5
f67b148a13ad3caa51c3c2ef142791ea- Authentihash SHA1
f621633290173daac18bb14ca3f52bc027cd2721- Authentihash SHA256
ac7b3c3b74e6e282c7f50c17a6213b81b181f779cd7c0c78e3cb426c427a98db- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- ASRock Incorporation
AsrDrv106n.sysSample 2 · HVCI FALSE
- MD5
7f9c2649000242416349e1e4f0f76955- SHA1
f7d41a8e2f35c555a28875ad99df477b28f9a2ae- SHA256
14c5576eda5a28d476a93c9cdb91236f18573dbd0578ac2bb183dfd115f4a166- Imphash
3edc8a0f9cf180b3687025e17be537cc- Authentihash MD5
3e7f6f2ba95f17d22ca93499406db76a- Authentihash SHA1
f2d3868c8de52cb84605bc59187118bb4e20e91e- Authentihash SHA256
8d6e7e7bbc5635af4a7cdcddcbc7da49420e9887b4f3a9baa95b49721226a8fc- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- ASRock Incorporation
Recorded command
sc.exe create AsrDrv106.sys binPath=C:\windows\temp\AsrDrv106.sys type=kernel && sc.exe start AsrDrv106.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: fluffycats31 @fluffycats31