Driver intelligenceVulnerableVerified

Khwmon.sys

Khwmon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / b98bc8f5-5dde-417f-a25c-41d95b867d75ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Khwmon.sysSample 1 · HVCI FALSE

MD5: 005e49b1f201461f067b093ef0d8d500
SHA1: 096b79450e308600400194cf8ec365be3d673332
SHA256: 103ce48e8491684f383d9851e4710cbb5c739b5c7f332f2d11b88babc2c217b5
Imphash: 2f6472f3fea81a83544554b1790c6d7b
Authentihash MD5: 58f0c2d067f79f42026a1df76f335977
Authentihash SHA1: 38ae6ac5db741a828bb1ba70fcf3287bc9f84ceb
Authentihash SHA256: 02d4eb48d6e2ecdf94d58b580dde17e899c161d3cf42aed4d4fb4ad7a2d9255a
Machine: AMD64
Version: 2013,4,15,5
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Khwmon binPath=C:\windows\temp\Khwmon.sys type=kernel && sc.exe start Khwmon

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint