Driver intelligenceVulnerableVerified

Windows-Memory-Informer.sys

Windows-Memory-Informer.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / e354b869-e817-4f9f-8027-a3d5bfb3689bADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Windows-Memory-Informer.sysSample 1 · HVCI TRUE

MD5: 6a978194ee4214b2410f70862663d977
SHA1: c281e8eda1234b58802b5f99bad4e70e579bc224
SHA256: 4cdae25483cb73a7a75dadc2d22c0115dece7e1a3c0162ae810e229faace5a44
Imphash: 9f60d3704674207759f2bbd8e68be113
Authentihash MD5: a4c884a581f6fa70ce76aa1897037ae4
Authentihash SHA1: b2080848b4c436945ef0ddcc56efd4809bc50c79
Authentihash SHA256: 7290fda4ac74e5873b8557b1669a0b859bf7bafbeafa0ea946709f686086b50f
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Windows-Memory-Informer binPath=C:\windows\temp\Windows-Memory-Informer.sys type=kernel && sc.exe start Windows-Memory-Informer

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint