Driver intelligenceVulnerableVerified

d591004.sys

d591004.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / c22dd43e-cf1f-4338-a109-d662198ffbe9ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

d591004.sysSample 1 · HVCI TRUE

MD5: 1ff3fade2ecd00882eefff12ebbb8783
SHA1: 1cb772bb82658593e2bf28330f4ad5e49041fec2
SHA256: 1da4f7f001d239a54fab50eb7c3cbc985db392a3d4405e19c3a5d2035d591004
Imphash: ff87cc76b7f8139549af27a98ea0587f
Authentihash MD5: 0f29659d77ca6df9f64c9a0bce73c9cd
Authentihash SHA1: bd1321f719681f9c692f56ecf3154ca131db80a6
Authentihash SHA256: 202f7501dbbdcd859b0211ab54f340723d005becce499ca1b3d8469e73529848
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create d591004 binPath=C:\windows\temp\d591004.sys type=kernel && sc.exe start d591004

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint