705330b3-5e2c-4c87-ab92-0f01b68b1b2d

dddriver64Dcsa.sys

Description

dddriver64Dcsa.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID: 705330b3-5e2c-4c87-ab92-0f01b68b1b2d
Created: 2026-04-17
Author: Michael Haag
Acknowledgement: fluffycats31 | [@rainbowdynamix, @DbgPrint, @fluffycats31](https://twitter.com/@rainbowdynamix, @DbgPrint, @fluffycats31)

Download

This download link contains the vulnerable driver!

Commands

sc.exe create dddriver64Dcsa binPath=C:\windows\temp\dddriver64Dcsa.sys type=kernel &amp;&amp; sc.exe start dddriver64Dcsa

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://github.com/magicsword-io/LOLDrivers/issues/325

https://github.com/KeServiceDescriptorTable/vulnerable-drivers

https://github.com/fluffycats31/vulnerable-drivers

Known Vulnerable Samples

Property	Value
Filename	dddriver64Dcsa.sys
Creation Timestamp	2019-10-29 23:51:57
MD5	85eca49a1b9d2787c13b2d32b0f693cb
SHA1	558e247370affd7c3f72b98864c1a1a2069ad7b0
SHA256	1f46f7a8f414bb1ac9f875799efa4b5f62bd18806c64b17d961007755accb5ab
Authentihash MD5	baa362cc2d52afa69db4b9a9f269c105
Authentihash SHA1	9d7588cd50dc3af4be8c3c534aa9204129aa0f03
Authentihash SHA256	b6d717d2497448eefa8d0be3b7b03030da63296ca932c00bfc8fdd71503c6d52
RichPEHeaderHash MD5	5805ea2ef9b9eeb53149440c2842065c
RichPEHeaderHash SHA1	a6c57063a5fe597e45d5b9e0d744668a07429c0d
RichPEHeaderHash SHA256	5d8d5bcd0a7444b5338e31076501cab896d707f11c28fe302b1b2cd51838182a
Company	Dell Inc.
Description	Dell Diags Universal Device Driver
Product	Dell Diags Universal Device Driver
OriginalFilename	dddriver64Dcsa.sys

Download

Certificates

Expand

Certificate 33000000857f83dc2a6ca979b8000000000085

Field	Value
ToBeSigned (TBS) MD5	85e8c40624a19ac2076dd91f49d8fb53
ToBeSigned (TBS) SHA1	621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca
ToBeSigned (TBS) SHA256	442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
ValidFrom	2019-06-05 18:06:32
ValidTo	2020-06-03 18:06:32
Signature	11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	33000000857f83dc2a6ca979b8000000000085
Version	3

Certificate 610baac1000000000009

Field	Value
ToBeSigned (TBS) MD5	a569061297e8e824767dbc3184a69bea
ToBeSigned (TBS) SHA1	adbb26a587a8f44b4fccaecb306f980d1c55a150
ToBeSigned (TBS) SHA256	cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
ValidFrom	2012-04-18 23:48:38
ValidTo	2027-04-18 23:58:38
Signature	5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	610baac1000000000009
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
WDFLDR.SYS

Imported Functions

Expand

KeQueryMaximumProcessorCountEx
MmFreeNonCachedMemory
RtlInitUnicodeString
KeSetSystemGroupAffinityThread
KeInitializeSpinLock
IoDeleteDevice
MmGetPhysicalAddress
KeRevertToUserGroupAffinityThread
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
KeReleaseSpinLock
KeSetTargetProcessorDpc
IoCreateDevice
IofCompleteRequest
IoCreateSymbolicLink
__C_specific_handler
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDetachDevice
RtlFreeUnicodeString
PoSetPowerState
IoAttachDeviceToDeviceStack
KeInitializeDpc
IofCallDriver
KeInitializeEvent
KeWaitForSingleObject
KeSetPriorityThread
PoCallDriver
PoRequestPowerIrp
PoStartNextPowerIrp
KeInsertQueueDpc
MmFreeContiguousMemory
MmAllocateContiguousMemory
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KeAcquireSpinLockRaiseToDpc
KeSetImportanceDpc
DbgPrint
ExAllocatePoolWithTag
ExFreePool
RtlCopyUnicodeString
RtlGetVersion
MmUnmapIoSpace
KeSetEvent
MmMapIoSpace
HalGetBusDataByOffset
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Exported Functions

Expand

Sections

Expand

.text
page
.rdata
.data
.pdata
PAGE
PAGED_CO
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Signature": "11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "85e8c40624a19ac2076dd91f49d8fb53",
        "SHA1": "621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca",
        "SHA256": "442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a",
        "SHA384": "19b80fb83482cdb42c94c2eabac29e4db7777988905aab348bd7ed62e325d2ea1f4c80df0d7275abcb2b67585cfc7c36"
      },
      "ValidFrom": "2019-06-05 18:06:32",
      "ValidTo": "2020-06-03 18:06:32",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "610baac1000000000009",
      "Signature": "5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "TBS": {
        "MD5": "a569061297e8e824767dbc3184a69bea",
        "SHA1": "adbb26a587a8f44b4fccaecb306f980d1c55a150",
        "SHA256": "cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46",
        "SHA384": "e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"
      },
      "ValidFrom": "2012-04-18 23:48:38",
      "ValidTo": "2027-04-18 23:58:38",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	dddriver64Dcsa.sys
Creation Timestamp	2019-10-29 23:51:57
MD5	50007d3a8b5d03dc1828202bc1afae41
SHA1	c1ecfd2e3fb65a9b1a415b2b3ac53ca4f6e4a51d
SHA256	1907ebc1398f8bf40c76065fd5b10872c3e947c051e62bc9feeb7316651aab0d
Authentihash MD5	baa362cc2d52afa69db4b9a9f269c105
Authentihash SHA1	9d7588cd50dc3af4be8c3c534aa9204129aa0f03
Authentihash SHA256	b6d717d2497448eefa8d0be3b7b03030da63296ca932c00bfc8fdd71503c6d52
RichPEHeaderHash MD5	5805ea2ef9b9eeb53149440c2842065c
RichPEHeaderHash SHA1	a6c57063a5fe597e45d5b9e0d744668a07429c0d
RichPEHeaderHash SHA256	5d8d5bcd0a7444b5338e31076501cab896d707f11c28fe302b1b2cd51838182a
Company	Dell Inc.
Description	Dell Diags Universal Device Driver
Product	Dell Diags Universal Device Driver
OriginalFilename	dddriver64Dcsa.sys

Download

Certificates

Expand

Certificate 33000000857f83dc2a6ca979b8000000000085

Field	Value
ToBeSigned (TBS) MD5	85e8c40624a19ac2076dd91f49d8fb53
ToBeSigned (TBS) SHA1	621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca
ToBeSigned (TBS) SHA256	442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
ValidFrom	2019-06-05 18:06:32
ValidTo	2020-06-03 18:06:32
Signature	11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	33000000857f83dc2a6ca979b8000000000085
Version	3

Certificate 610baac1000000000009

Field	Value
ToBeSigned (TBS) MD5	a569061297e8e824767dbc3184a69bea
ToBeSigned (TBS) SHA1	adbb26a587a8f44b4fccaecb306f980d1c55a150
ToBeSigned (TBS) SHA256	cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
ValidFrom	2012-04-18 23:48:38
ValidTo	2027-04-18 23:58:38
Signature	5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	610baac1000000000009
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
WDFLDR.SYS

Imported Functions

Expand

KeQueryMaximumProcessorCountEx
MmFreeNonCachedMemory
RtlInitUnicodeString
KeSetSystemGroupAffinityThread
KeInitializeSpinLock
IoDeleteDevice
MmGetPhysicalAddress
KeRevertToUserGroupAffinityThread
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
KeReleaseSpinLock
KeSetTargetProcessorDpc
IoCreateDevice
IofCompleteRequest
IoCreateSymbolicLink
__C_specific_handler
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDetachDevice
RtlFreeUnicodeString
PoSetPowerState
IoAttachDeviceToDeviceStack
KeInitializeDpc
IofCallDriver
KeInitializeEvent
KeWaitForSingleObject
KeSetPriorityThread
PoCallDriver
PoRequestPowerIrp
PoStartNextPowerIrp
KeInsertQueueDpc
MmFreeContiguousMemory
MmAllocateContiguousMemory
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KeAcquireSpinLockRaiseToDpc
KeSetImportanceDpc
DbgPrint
ExAllocatePoolWithTag
ExFreePool
RtlCopyUnicodeString
RtlGetVersion
MmUnmapIoSpace
KeSetEvent
MmMapIoSpace
HalGetBusDataByOffset
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Exported Functions

Expand

Sections

Expand

.text
page
.rdata
.data
.pdata
PAGE
PAGED_CO
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Signature": "11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "85e8c40624a19ac2076dd91f49d8fb53",
        "SHA1": "621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca",
        "SHA256": "442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a",
        "SHA384": "19b80fb83482cdb42c94c2eabac29e4db7777988905aab348bd7ed62e325d2ea1f4c80df0d7275abcb2b67585cfc7c36"
      },
      "ValidFrom": "2019-06-05 18:06:32",
      "ValidTo": "2020-06-03 18:06:32",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "610baac1000000000009",
      "Signature": "5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "TBS": {
        "MD5": "a569061297e8e824767dbc3184a69bea",
        "SHA1": "adbb26a587a8f44b4fccaecb306f980d1c55a150",
        "SHA256": "cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46",
        "SHA384": "e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"
      },
      "ValidFrom": "2012-04-18 23:48:38",
      "ValidTo": "2027-04-18 23:58:38",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2026-08-31

705330b3-5e2c-4c87-ab92-0f01b68b1b2d

dddriver64Dcsa.sys

Description

Block dddriver64Dcsa.sys across your endpoints

Commands

Detections

YARA 🏹

Sigma 🛡️

Sysmon 🔎

Resources

Known Vulnerable Samples

Certificates

Certificate 33000000857f83dc2a6ca979b8000000000085

Certificate 610baac1000000000009

Imports

Imported Functions

Exported Functions

Sections

Signature

Certificates

Certificate 33000000857f83dc2a6ca979b8000000000085

Certificate 610baac1000000000009

Imports

Imported Functions

Exported Functions

Sections

Signature