LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

dddriver64Dcsa.sys

dddriver64Dcsa.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 705330b3-5e2c-4c87-ab92-0f01b68b1b2dADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 2

1 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

dddriver64Dcsa.sysSample 1 · HVCI TRUE
MD5
85eca49a1b9d2787c13b2d32b0f693cb
SHA1
558e247370affd7c3f72b98864c1a1a2069ad7b0
SHA256
1f46f7a8f414bb1ac9f875799efa4b5f62bd18806c64b17d961007755accb5ab
Imphash
67965c1ed4aaccae610f743ae2dfb65b
Authentihash MD5
baa362cc2d52afa69db4b9a9f269c105
Authentihash SHA1
9d7588cd50dc3af4be8c3c534aa9204129aa0f03
Authentihash SHA256
b6d717d2497448eefa8d0be3b7b03030da63296ca932c00bfc8fdd71503c6d52
Machine
AMD64
Version
2.0.3.0
Publisher
Dell Inc.
Download vulnerable sampleView on VirusTotal
dddriver64Dcsa.sysSample 2 · HVCI FALSE
MD5
50007d3a8b5d03dc1828202bc1afae41
SHA1
c1ecfd2e3fb65a9b1a415b2b3ac53ca4f6e4a51d
SHA256
1907ebc1398f8bf40c76065fd5b10872c3e947c051e62bc9feeb7316651aab0d
Imphash
67965c1ed4aaccae610f743ae2dfb65b
Authentihash MD5
baa362cc2d52afa69db4b9a9f269c105
Authentihash SHA1
9d7588cd50dc3af4be8c3c534aa9204129aa0f03
Authentihash SHA256
b6d717d2497448eefa8d0be3b7b03030da63296ca932c00bfc8fdd71503c6d52
Machine
AMD64
Version
2.0.3.0
Publisher
Dell Inc.
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create dddriver64Dcsa binPath=C:\windows\temp\dddriver64Dcsa.sys type=kernel && sc.exe start dddriver64Dcsa

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: fluffycats31 @rainbowdynamix, @DbgPrint, @fluffycats31