← Back to driver explorer
Driver intelligenceMaliciousVerified
RzDev_00X10.sys
Nextron Systems identifies this exact sample as a kernel communication and memory-access component with a covert user-to-kernel channel and privileged memory read/write. Static analysis confirms MDL-backed kernel mappings and a transfer path that probes a caller buffer and maps supplied virtual ranges in page-sized chunks. The obfuscated transfer callback was not fully resolved; the covert channel and privileged memory read/write semantics are source-reported, not independently demonstrated. The observed RzDev_00X10.sys filename does not establish vendor ownership.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
RzDev_00X10.sysSample 1 · HVCI unknown
- MD5
e96522a7b9b55917a01f953018116d18- SHA1
22921d8c47579b8bd0a513e6e052e4a5cf50068a- SHA256
80f97dabef128a391e3ad10e4521dd0a28adc01a97e1cef980f535ac23bd0847- Imphash
663aaaf0575ac1d44d8fc39b03d2c62d- Authentihash MD5
230ac8e5ae21258d4af9007027ffe99e- Authentihash SHA1
bd8609c22fd2f655e7831cc7eb1bce1e44f66896- Authentihash SHA256
afba0119386ba096b576328f20a8a6e5539c018057c5ac4c0376f03f0b1f6c90- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Research & references
Acknowledgement: Nextron Systems Research @nextronresearch

