Driver intelligenceVulnerableVerified

pcdsrvc_x64.sys

PC-Doctor pcdsrvc_x64.sys is listed as a KDU provider for Dell PC Doctor / SupportAssist driver abuse. The driver family is associated with CVE-2019-12280 and exposes kernel access primitives used by KDU as a provider for kernel memory operations.

UUID / d4eb6ed4-c23f-45a9-9891-5aa8f218b863ADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

pcdsrvc_x64.sysSample 1 · HVCI unknown

MD5: 4b5f5774ff1c577b9515fdd2b5c535c5
SHA1: d0a228ed8af190dec0c1a812e212f5e68ee3b43e
SHA256: 1d053020079124ac526d84affb17bf4a1563ecd872c83b4b6299c9aa6a732557
Imphash: ee80920dc13af08a91dc574363231916
Authentihash MD5: 115aaed3d6a380b9e5cbf1fc61d453f5
Authentihash SHA1: 85d493f5636b46f6c4f8b1028f8e8659f31dc562
Authentihash SHA256: 61abb8bf6498adf31f9bbeb4f25f97c2003dc6c9d5580d84361b2be693ca4676
Machine: AMD64
Version: 6.2.2.0
Publisher: PC-Doctor, Inc.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create pcdsrvc_x64 binPath=C:\windows\temp\pcdsrvc_x64.sys type=kernel && sc.exe start pcdsrvc_x64

Access privileged kernel primitives through a KDU-supported vulnerable driver provider. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: KDU Project / SharpKernel @hfiref0x / @hsheric0210