Driver intelligenceVulnerableVerified

iOCdrv.sys

iOCdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 9bf541fb-a68e-41a5-aab2-b939acc22bb1ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

iOCdrv.sysSample 1 · HVCI FALSE

MD5: 4b1d81db39537320eb823f5b4f2489e2
SHA1: 8a76cad761b978934d45584d4af8eb5b67f6fed1
SHA256: b936c4ba80ccee3b0b3b67fc88c8caa103fcfc47888e976f6d5b6f113d22f41f
Imphash: f4b16a2aac3a765538ac99aa7c973d5d
Authentihash MD5: e7d3089cafa734d8799aed54b501e386
Authentihash SHA1: ca8cded2bbfea3ba693be4beeb10635b143ed594
Authentihash SHA256: 5d108befdc9c3e226b12a22e306ccaa1e66ffd14a328b1ddb1f0ab0c32798bb7
Machine: AMD64
Version: 6.5.1.31
Publisher: Intel Corporation

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create iOCdrv binPath=C:\windows\temp\iOCdrv.sys type=kernel && sc.exe start iOCdrv

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint