Driver intelligenceVulnerableVerified

dcr.sys

DriveCrypt Dcr.sys vulnerability exploit for bypassing x64 DSE

UUID / b1dd91b1-9ba3-4d68-a2d1-919039e18430ADDED / 2023-04-14AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

dcr.sysSample 1 · HVCI FALSE

MD5: c24800c382b38707e556af957e9e94fd
SHA1: b49ac8fefc6d1274d84fef44c1e5183cc7accba1
SHA256: 3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5
Imphash: 858ceae385cdcfcbc7814644564c23e6
Authentihash MD5: accf79b751fafb101c1ce17fb7611b70
Authentihash SHA1: 8f2f1684a7305f32015d54c402790a47c6c7a0c9
Authentihash SHA256: 2b60228db4f3092063e115537b5731ef3487ecf55c036e812605c5149071332c
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

sc.exe create dcr.sys binPath=C:\windows\temp\dcr.sys type=kernel && sc.exe start dcr.sys

Elevate privileges · Privileges: kernel · OS: Windows 10