Driver intelligenceVulnerableVerified

filwfp.sys

Twister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.

UUID / 9d4358c3-5d6e-48a0-971e-e2ad7724c106ADDED / 2024-06-20AUTHOR / VirarK

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

filwfp.sysSample 1 · HVCI TRUE

MD5: 09a85a7798059699231c111176a56a16
SHA1: 55a540e91527b4c0eadfdf01426bb841f590d9bb
SHA256: 490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a
Imphash: 6461061c996437e942bd925300b79263
Authentihash MD5: 5aa51bc81bb52456cfde02916ae46545
Authentihash SHA1: 25d318c988e09b38da0181be689b7c7ebeba22b2
Authentihash SHA256: d253561067550539a9aca8884846432116fac5eee9948f2c5bdce7cf61985b7d
Machine: AMD64
Version: 1, 0, 0, 1216
Publisher: Filseclab Corporation

sc.exe create filwfp.sys binPath=C:\windows\temp\filwfp.sys type=kernel && sc.exe start filwfp.sys

Elevate privileges · Privileges: kernel · OS: Windows 10