← Back to driver explorer
Driver intelligenceVulnerableVerified
mydrivers.sys
DriverGenius mydrivers.sys 9.2.707.1214 is affected by CVE-2023-1676. IOCTL 0x9C402088 dispatches caller-controlled values to the privileged WRMSR instruction without adequate access control. A local user can corrupt kernel state, execute code in ring 0, and elevate privileges.
Known samples 2
0 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
mydrivers.sysSample 1 · HVCI unknown
- MD5
e85f24190d4849eaa331f048de3913e6- SHA1
5b2f7a72a319f6f00464f2d5e3d3518e62f86e76- SHA256
a2e11d0eec70bf0818aeef0a9676cc4157bb34e06fbe54631eb98b51fc8d92c8- Imphash
d6f977640d4810a784d152e4d3c63a6b- Authentihash MD5
e89988778c4538e1331519145745d0ce- Authentihash SHA1
6e319c855b137135e32c472283000d662208c39d- Authentihash SHA256
b47a2f1cf946fb140039d9818693d664ea2f0f8ec9cf3047b0065aba04e2fc13- Machine
- AMD64
- Version
- 9.2.707.1214
- Publisher
- MyDrivers.com
mydrivers.sysSample 2 · HVCI FALSE
- MD5
507a649eb585d8d0447eab0532ef0c73- SHA1
7859e75580570e23a1ef7208b9a76f81738043d5- SHA256
08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6- Imphash
a1d29a3af6402793ec9d23883512938a- Authentihash MD5
74a1e675b4fd736298bc24d082684b0e- Authentihash SHA1
c57e38ce02ba45c3ad886faff98fe346560b1f5e- Authentihash SHA256
a689804c4e6e9aa07d48f9c99b7a1be6b05cba1c632b1a083b8031f6e1651c28- Machine
- I386
- Version
- 9.2.707.1214
- Publisher
- MyDrivers.com
Recorded command
sc.exe create mydrivers.sys binPath=C:\windows\temp\mydrivers.sys type=kernel && sc.exe start mydrivers.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://nvd.nist.gov/vuln/detail/CVE-2023-1676
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1676