Driver intelligenceVulnerableVerified

SONiXDDRx64.sys

SONiXDDRx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 9720d49d-c20f-479e-9284-2b3ad120fdf8ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SONiXDDRx64.sysSample 1 · HVCI FALSE

MD5: 5045d10b6d47f3b0d35f0489c05b9a02
SHA1: 4e384a43e4f2af55e5a7859ea8122f488e0849ab
SHA256: 85a4ce446d9ccd93c2f14d2e0f30ea673812ce740438abb199a8047510614a76
Imphash: b62e9f4f8363c29992802646a5b4fa4b
Authentihash MD5: 2898890d13a996d740bf3c1059cdbb88
Authentihash SHA1: dd2ca2668f7db90e206499c8e80c29d80bea5f45
Authentihash SHA256: e7e162c487d9d3595fe6c7844eeb5668657a6f43fee78e9455d15770ab287432
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create SONiXDDRx64 binPath=C:\windows\temp\SONiXDDRx64.sys type=kernel && sc.exe start SONiXDDRx64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint