← Back to driver explorer
Driver intelligenceVulnerableVerified
ProcObsrvesx.sys
Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
ProcObsrvesx.sysSample 1 · HVCI TRUE
- MD5
10dd681f56cfbb329c7f470ebb9f4b31- SHA1
1b10f5686ccd82905b9e4392653d2e7797c360fa- SHA256
37206b758eac2c7775ef881c1dc9a96129a517069bdf47049afc3b29e328408e- Imphash
bdb6b285ef680effb0cf348a136bb871- Authentihash MD5
4dda010a527a13652645cb6200a348ee- Authentihash SHA1
95dd4f737c95b7fcd1258fe41334b8fb125e1c8b- Authentihash SHA256
a4c0e1bf3b397ebe5105a15dce686d7a171e01d5d4af32d67a8974de55afdf19- Machine
- AMD64
- Version
- 4, 0, 0, 49
- Publisher
- MicroWorld Technologies Inc.
Recorded command
sc.exe create ProcObsrvesx binPath=C:\windows\temp\ProcObsrvesx.sys type=kernel && sc.exe start ProcObsrvesxElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Northwave Cyber Security