Driver intelligenceVulnerableVerified

MemCtl.sys

MemCtl.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / ae2a6048-3896-4dd8-9eb1-a4a66104b0cfADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

MemCtl.sysSample 1 · HVCI FALSE

MD5: bc19a1a76e61bd56544c0e82c8a99979
SHA1: 50df08355fca51fd5d6a22f8220a2fc45f858f2b
SHA256: fe9323ede771de8ff389ba161ad8696cd6cd788dbf7dd382b6b79011544eed73
Imphash: 340e874a1ca966e45fc2a314ef228cce
Authentihash MD5: 2abb632c0eb107bfe466c5a828257ce1
Authentihash SHA1: 6df86643d30590d45c0dbac9a40bb59c7859f60b
Authentihash SHA256: 414d56461869ed3f6a5a04b3c50aefe90275288d303cce14c5b06b6ec12fb376
Machine: AMD64
Version: 1, 4, 2011, 2
Publisher: DFI

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create MemCtl binPath=C:\windows\temp\MemCtl.sys type=kernel && sc.exe start MemCtl

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint