Driver intelligenceVulnerableVerified

RwDrv.sys

Description not recorded.

UUID / b03798af-d25a-400b-9236-4643a802846fADDED / 2023-05-06AUTHOR / Nasreddine Bencherchali

Known samples 7

2 recorded TRUE · 5 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

RwDrv.sysSample 1 · HVCI FALSE

MD5: f853abe0dc162601e66e4a346faed854
SHA1: 35b28b15835aa0775b57f460d8a03e53dc1fb30f
SHA256: 1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe
Imphash: 955e7b12a8fa06444c68e54026c45de1
Authentihash MD5: 9996409a6c7c91374a597ea9d1f7799c
Authentihash SHA1: 5851f58c92f8fd548c42f10c258d1e95afe7ce88
Authentihash SHA256: 1fd7a44b042d397ad5a6417e4aa4b30eb2e40df6274d3ac7155ecc68c88cdb6d
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 2 · HVCI FALSE

MD5: 4ad30223df1361726ff64417f8515272
SHA1: 3f6a997b04d2299ba0e9f505803e8d60d0755f44
SHA256: 2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f
Imphash: 9d7183c1d8107495354c4fad9dae3452
Authentihash MD5: a3b9e0285d00597ea1531664a051be06
Authentihash SHA1: e7fac017b371a43276e03bf5f71d437e8d377930
Authentihash SHA256: 0a3090ae46b3ce5f4cc6ba2d4dd265033e23c813d5c1e9c7a20a84d5d167dae3
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 3 · HVCI FALSE

MD5: 969f1d19449dc5c2535dd5786093f651
SHA1: 78834ff75e2ff8b7456e85114802e58bc9fda457
SHA256: 2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14
Imphash: 9d7183c1d8107495354c4fad9dae3452
Authentihash MD5: a36411168cc8b448c6864d890c7727ea
Authentihash SHA1: c2f2ac17f06be23c0b71f929ea63356123f3a72f
Authentihash SHA256: aa7f25d4857a4b443222934bcbb0904348a799fc884096f653d921817c0b34aa
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 4 · HVCI TRUE

MD5: c2585e2696e21e25c05122e37e75a947
SHA1: f736ccbb44c4de97cf9e9022e1379a4f58f5a5b8
SHA256: 3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf
Imphash: 955e7b12a8fa06444c68e54026c45de1
Authentihash MD5: 0496b6428ce874959af5387ce44b4eaf
Authentihash SHA1: 39257fb86df888207e4f3a7768561b4ab1557848
Authentihash SHA256: d475c4fe917020d420b5d0cf1f074b1427f49bd1f4414873501be51700f8832d
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 5 · HVCI FALSE

MD5: 7437d4070b5c018e05354c179f1d5e2a
SHA1: 03a56369b8b143049a6ec9f6cc4ef91ac2775863
SHA256: 3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de
Imphash: 955e7b12a8fa06444c68e54026c45de1
Authentihash MD5: 7fd75a9a4906445cc73a0a402bae506a
Authentihash SHA1: cd111bf04815d4d1040a2813efb2d15ccfbd9b74
Authentihash SHA256: a97e5c6cd926fa47ab1a69963169223cc669bd654a2f128165ba4ebe1d08bd17
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 6 · HVCI TRUE

MD5: 903c149851e9929ec45daefc544fcd99
SHA1: 1901467b6f04a93b35d3ca0727c8a14f3ce3ed52
SHA256: 45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a
Imphash: 955e7b12a8fa06444c68e54026c45de1
Authentihash MD5: 0496b6428ce874959af5387ce44b4eaf
Authentihash SHA1: 39257fb86df888207e4f3a7768561b4ab1557848
Authentihash SHA256: d475c4fe917020d420b5d0cf1f074b1427f49bd1f4414873501be51700f8832d
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

RwDrv.sysSample 7 · HVCI FALSE

MD5: 60e84516c6ec6dfdae7b422d1f7cab06
SHA1: 66e95daee3d1244a029d7f3d91915f1f233d1916
SHA256: d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d
Imphash: 955e7b12a8fa06444c68e54026c45de1
Authentihash MD5: 0496b6428ce874959af5387ce44b4eaf
Authentihash SHA1: 39257fb86df888207e4f3a7768561b4ab1557848
Authentihash SHA256: d475c4fe917020d420b5d0cf1f074b1427f49bd1f4414873501be51700f8832d
Machine: AMD64
Version: 1.00.00.0000 built by: WinDDK
Publisher: RW-Everything

sc.exe create RwDrv.sys binPath=C:\windows\temp\RwDrv.sys type=kernel && sc.exe start RwDrv.sys

Elevate privileges · Privileges: kernel · OS: Windows 10