Driver intelligenceVulnerableVerified

mtxmem.sys

mtxmem.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 7c766ce5-fa74-4080-907d-95f2f68d49e7ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

mtxmem.sysSample 1 · HVCI FALSE

MD5: 0b664978b24775689f8bc1afc86e05da
SHA1: 8c5fd6fb98bed0c040c6962bc2c3111c1bfcbc84
SHA256: bd434c90eba514f5448978edb8b9fcd424f2e5cf3c0df9040efe5c25ec692dbc
Imphash: 5af9afb68dc6b0ed8e7d30b2fac5b6e7
Authentihash MD5: 6189512b3f79b36867b15a6717a3398c
Authentihash SHA1: 9c7dca8a2802be34425838ef0d7664e976c34f91
Authentihash SHA256: 2704a256d2f4c9177462a134f835c1abe206831e594011c69e7655d19c51d480
Machine: AMD64
Version: 10.50.0923.4242
Publisher: Matrox Electronic Systems Ltd.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create mtxmem binPath=C:\windows\temp\mtxmem.sys type=kernel && sc.exe start mtxmem

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint