Driver intelligenceVulnerableVerified

ditpio64.sys

ditpio64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 843a028a-e998-42cb-874c-4478680af397ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ditpio64.sysSample 1 · HVCI FALSE

MD5: 0928a0e981ebf188ccce402162ec8fb4
SHA1: af358b3b78ec40249cce93722f57a873b4fc2d92
SHA256: 33f9f2aa566d0873777e841c8cd970298a93206d3be4dfd30fee726eb0d47585
Imphash: 19a2e42a9bd77f622ae26a23c66416f3
Authentihash MD5: 83410ec4038288c3cf0f3c6e9319d211
Authentihash SHA1: b3cec5b3c320de9800c0456eada95846cabe9c06
Authentihash SHA256: 64ff3b13b33cccaa3fd042251c1a6dee18086db11bfbf6d398484fedaadaacff
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create ditpio64 binPath=C:\windows\temp\ditpio64.sys type=kernel && sc.exe start ditpio64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint