← Back to driver explorer
Driver intelligenceMaliciousVerified
wfshbr64.sys
wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature). The driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
wfshbr64.sysSample 1 · HVCI FALSE
- MD5
b76aee508f68b5b6dccd6e1f66f4cf8b- SHA1
0167259abd9231c29bec32e6106ca93a13999f90- SHA256
b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c- Imphash
df43355c636583e56e92142dcc69cc58- Authentihash MD5
f143857a68801478dbe4de842a9d4f6a- Authentihash SHA1
47063aa084976104d928e2b0f4f4b800adb22c89- Authentihash SHA256
b0399dd3c395f84cbd6ac2e3e8ca8ee344a0f699b17db0624f936ae4bb4b7953- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
wfshbr64.sysSample 2 · HVCI FALSE
- MD5
c9d4214c850e0cedf033dc8f0cd3aace- SHA1
b2f5d3318aab69e6e0ca8da4a4733849e3f1cee2- SHA256
89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3- Imphash
df43355c636583e56e92142dcc69cc58- Authentihash MD5
82a8528c1c8391d38cbd90ba8823f833- Authentihash SHA1
0122f7a57784f2ac460d175687450d8940cace6e- Authentihash SHA256
d16a59cd7c52d1d32bb43670cdca739aadb19ba15996bac62071845e1bfbdb95- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create wfshbr64.sys binPath=C:\windows\temp\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sysElevate privileges · Privileges: kernel · OS: Windows 10