← Back to driver explorer
Driver intelligenceVulnerableVerified
PSKD64.SYS
APSoft PCIScope's PSKD64 driver exposes memory-access operations through \\.\PSKD64. IOCTL 0x220044 dispatches sub-operations 0x701E and 0x701F for caller-selected virtual or physical memory reads and writes without constraining the target address. Public testing demonstrates arbitrary kernel read/write on Windows 11, including process protection removal and security-process termination.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
PSKD64.SYSSample 1 · HVCI unknown
- MD5
741daa162541343e15f0448487ca52c5- SHA1
9bd89c27aa2b230feea1171798bfc0e24652444a- SHA256
34cdbf48f5a51ca9553c14f007aaa1b67c24e1334d8cb29e80f07c80c5dc07e7- Imphash
cec72858409b9ae0decb0b0cd9111791- Authentihash MD5
2eb18722d74040a5f2713f958b1fc2b1- Authentihash SHA1
5f0369a2f3f9ffc931ef1a982e5685a8ade50add- Authentihash SHA256
d53d5e1311f42580e5cbc675f6435753dd5869418ff47451a0b372f841662534- Machine
- AMD64
- Version
- 4.00.032
- Publisher
- APSoft
Recorded command
sc.exe create PSKD64 binPath= C:\windows\temp\PSKD64.SYS type= kernel && sc.exe start PSKD64Read or write arbitrary kernel memory to disable security controls or elevate privileges. · Privileges: Administrator · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Venexy, Dark Monkey @M4xSec, @v8k6b2jjps-prog