← Back to driver explorer
Driver intelligenceVulnerableVerified
CorsairLLAccess64.sys
Corsair LL Access 1.0.22.0 maps caller-selected physical addresses with MmMapIoSpace and can expose the mapped pages to user mode through MmMapLockedPagesSpecifyCache. These physical-memory access primitives can be abused for kernel tampering by an attacker able to load and open the driver.
Known samples 5
0 recorded TRUE · 5 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
CorsairLLAccess64.sysSample 1 · HVCI FALSE
- MD5
b34361d151c793415ef92ee5d368c053- SHA1
89656051126c3e97477a9985d363fbdde0bc159e- SHA256
29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6- Imphash
163436e69f8e582bdc1c1e6f735de23b- Authentihash MD5
7158180c7f219093d504d695240c2173- Authentihash SHA1
0302854ea87dc07a493aca60e8e7e63422932e42- Authentihash SHA256
b5606dc2a76350916cd77348cfdfe502256d759a4743dd4af503d2f7f348eb70- Machine
- AMD64
- Version
- 1.0.16.0
- Publisher
- Corsair Memory, Inc.
CorsairLLAccess64.sysSample 2 · HVCI FALSE
- MD5
3b9698a9ee85f0b4edf150deef790ccd- SHA1
fbfabf309680fbf7c0f6f14c5a0e4840c894e393- SHA256
5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36- Imphash
44cbd2ee295f1a35795eb4cd7cdd0864- Authentihash MD5
2c91bc52c8cda89db47907b88590a2a0- Authentihash SHA1
2129fd9cf3839001abea6bab0bbde224abad967c- Authentihash SHA256
a52a6fe55bd1c294d6f26b68839770d97850e9ccd5ecfd7f96b9dc4386e0ff08- Machine
- I386
- Version
- 1.0.16.0
- Publisher
- Corsair Memory, Inc.
CorsairLLAccess64.sysSample 3 · HVCI FALSE
- MD5
30efb7d485fc9c28fe82a97deac29626- SHA1
85941b94524da181be8aad290127aa18fc71895c- SHA256
a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d- Imphash
82e75304c5b7ed87121b8b89c82f2389- Authentihash MD5
e5c1ddfd9df7a473d9394ec219ffaa15- Authentihash SHA1
c0e1d74e70c5350e23c51209aa8b5df87bdf5642- Authentihash SHA256
cff3fc66d54279b755ceedf89268847dbb5139227739e4689f5d9271b1d7923b- Machine
- I386
- Version
- 1.0.18.0
- Publisher
- Corsair Memory, Inc.
CorsairLLAccess64.sysSample 4 · HVCI FALSE
- MD5
f042e8318cf20957c2339d96690c3186- SHA1
2871a631f36cd1ea2fd268036087d28070ef2c52- SHA256
f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1- Imphash
44cbd2ee295f1a35795eb4cd7cdd0864- Authentihash MD5
0249d3e10b361ce69d1e7a44889ed8b7- Authentihash SHA1
fc577f0a129354623164e81fd287ebd6546c8ca3- Authentihash SHA256
09bc9d0606d8b96f1d9fb18741bdb43aa5c188981d298df047b8c75351d68653- Machine
- I386
- Version
- 1.0.15.0
- Publisher
- Corsair Memory, Inc.
Corsair LL AccessSample 5 · HVCI FALSE
- MD5
3b41f4ccee2c1f132ffc7cdd9e5dd98e- SHA1
76f17945b736ee3fd1a887833f88ed1775ba0aab- SHA256
6c264246efbfb2db0e5c82e8a4e9ad896872cd306c71af5b7b242fb7b3ff3ab1- Imphash
b1de401efd9d1c08f251d13cbbdf568d- Authentihash MD5
abeb82efc4510e3e854e77b812779150- Authentihash SHA1
41e3810fd1918bc262bea7f61171ecf07bdb3566- Authentihash SHA256
a88a6133e7c838f38ea832c163333e7acf1c90277442ff7f51e1999338961604- Machine
- AMD64
- Version
- 1.0.22.0
- Publisher
- Corsair Memory, Inc.
Recorded command
sc.exe create CorsairLLAccess64.sys binPath=C:\windows\temp\CorsairLLAccess64.sys type=kernel && sc.exe start CorsairLLAccess64.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Patrick Saif, fluffycats31 @weezerOSINT, @fluffycats31