Driver intelligenceVulnerableVerified

DDDriver.sys

DDDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 6f6aedb9-aeaf-4c13-9d6d-37f062728c38ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

DDDriver.sysSample 1 · HVCI FALSE

MD5: 3802cbf4bdde6f99974b27ee1782e5f9
SHA1: 8fb8c4fd3fb27ac3dce230253b3c7e53943a9662
SHA256: 51562209e16a1c0247d73d7bfc8827ae4a2e57af11350379a8fba1ec44e56e54
Imphash: 35943a10476a54713aa059da8430d819
Authentihash MD5: cd4c5b5b6344fee2bdf9094cd6065b48
Authentihash SHA1: 4c9dbb9bcd098a686b2b4104e8f1bc3f38f7635c
Authentihash SHA256: 8e7e98ceafb412758ee40a6d8ff7d65397c82b8a18ca74841a9e1cf05e45f95f
Machine: AMD64
Version: 1.1.0.0
Publisher: Dell Computer Corporation

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create DDDriver binPath=C:\windows\temp\DDDriver.sys type=kernel && sc.exe start DDDriver

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint