Driver intelligenceVulnerableVerified

portwell.sys

portwell.sys is a kernel driver from Portwell Inc. (Taiwan) that exposes physical memory read/write via MmMapIoSpace. Portwell manufactures embedded computing platforms and industrial PCs. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.

UUID / 84f92ac1-1e72-420d-9cc0-65c838b90a4dADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

portwell.sysSample 1 · HVCI FALSE

MD5: a93b28348e04109cc186b985c9308295
SHA1: a7b72d8a1751a10643c1cc1c148175ca13bcbebe
SHA256: 2f0b16ed90b8c15bf52a7c32699dbe0dbcd38fc02ed2ddb4e1ba35487177b6c5
Imphash: 3e7652a1d28db44c532a007ef80fa618
Authentihash MD5: 94b8f3169c7e3644e9f8d8a8aa8ac94f
Authentihash SHA1: d7246621a438764a98f3d66ce0e393cfceb500d7
Authentihash SHA256: 2c451270999882f56418f1dbe35fc833bb51a9b08ae590a7e407790883537647
Machine: AMD64
Version: 0.1.0.0
Publisher: Portwell Inc.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create portwell binPath=C:\windows\temp\portwell.sys type=kernel && sc.exe start portwell

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint