← Back to driver explorer
Driver intelligenceVulnerableVerified
MonProcessEX.sys
MonProcessEX.sys is a HONOR MagicAnimation and HONOR PCManager kernel driver that exposes IOCTL 0x22400C to reach ZwTerminateProcess. The device is accessible to LocalSystem and local administrators, and the process-termination path does not verify the caller, allowing an administrator-accessible client to terminate arbitrary user-mode processes except PID 0 and PID 4 from kernel mode.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
MonProcessEX.sysSample 1 · HVCI unknown
- MD5
b32a250d1ef99bb62dd66cea60311f43- SHA1
e674c507ca0c61854c61e316acdf711c790f5d24- SHA256
72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258- Imphash
e5c2e380d0150ab25a79920138b8cc4b- Authentihash MD5
8816668de83718556497b2e45d169689- Authentihash SHA1
2b703146815077e6c4a593e547f2dc55f3484b7f- Authentihash SHA256
7a2b0415957f71aa019d1ce9e8f399130d71dfe5d1b6c83cc8b1182109f414eb- Machine
- AMD64
- Version
- 1.0.0.1
- Publisher
- Honor Device Co., Ltd.
Recorded command
sc.exe create MonProcessEX binPath=C:\windows\temp\MonProcessEX.sys type=kernel && sc.exe start MonProcessEXTerminate arbitrary processes through an insufficiently protected kernel IOCTL handler. · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @wwwab123