← Back to driver explorer
Driver intelligenceVulnerableVerified
HwRwDrv.sys
Hardware read/write driver signed by a revoked Certum certificate (Open Source Developer, Jun Liu). Provides arbitrary physical memory read/write and PCI bus data access. Identified in ESET EDR killers research (March 2026) with 174 execution parents indicating widespread abuse by threat actors to disable EDR products.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
HwRwDrv.sysSample 1 · HVCI unknown
- MD5
a2b2cacd5ab0e553d9b3d359564014dc- SHA1
db8bcb8693ddf715552f85b8e2628f060070f920- SHA256
017933be6023795e944a2a373e74e2cc6885b5c9bc1554c437036250c20c3a7d- Imphash
d6f977640d4810a784d152e4d3c63a6b- Authentihash MD5
212b7b4655e27c7ee3e3b20666067a69- Authentihash SHA1
8c40a82df3d606a87df243c787283c26ce9b0458- Authentihash SHA256
579b30aab603eb66d04584d227da63bbe9dc0910792e8208df1ec29c072a651c- Machine
- AMD64
- Version
- 1.0.6.0
- Publisher
- Windows® winows 7 driver kits provider
Recorded command
sc.exe create HwRwDrv.sys binPath=C:\windows\temp\HwRwDrv.sys type=kernel && sc.exe start HwRwDrv.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: ESET Research @ESETresearch