Driver intelligenceVulnerableVerified

l1malwarebits.sys

l1malwarebits.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / ec521bd5-8a3f-46ec-b6d3-414b79977a7eADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

l1malwarebits.sysSample 1 · HVCI TRUE

MD5: b3ce4e620e0e7c45f84000c5eac2a8e9
SHA1: 36c520b1d814ee89bd9161f6b31953fa2ae7850b
SHA256: d6d219628ab3acdc799b1b631d378742a4b266d6f55b12e568e4054091b08be6
Imphash: 369597a629eb010c4bff976ff26e4689
Authentihash MD5: 27fdb81be6651bafce2c09b6f24cc363
Authentihash SHA1: 2e75becb26b9856e3847c1d370b95080b30d77f4
Authentihash SHA256: bf92b2918557f6251c798d2843fb694540dbd29f62689a028ff0a2a525986625
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create l1malwarebits binPath=C:\windows\temp\l1malwarebits.sys type=kernel && sc.exe start l1malwarebits

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint