← Back to driver explorer
Driver intelligenceVulnerableVerified
kprocesshacker.sys
Description not recorded.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
krpocesshacker.sysSample 1 · HVCI FALSE
- MD5
bbbc9a6cc488cfb0f6c6934b193891eb- SHA1
d8498707f295082f6a95fd9d32c9782951f5a082- SHA256
c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c- Imphash
821d74031d3f625bcbd0df08b70f1e77- Authentihash MD5
a9ccdbae433c4377abce8f514e4fe43e- Authentihash SHA1
61b55bb7c111f93bd3ea9ac71591e1a6b89feee1- Authentihash SHA256
c7b1bb39dcd7f0331989f16fcc7cd29a9ae126bee47746a4be385160da3c5a29- Machine
- AMD64
- Version
- 2.8
- Publisher
- wj32
kprocesshacker.sysSample 2 · HVCI FALSE
- MD5
1b5c3c458e31bede55145d0644e88d75- SHA1
a21c84c6bf2e21d69fa06daaf19b4cc34b589347- SHA256
70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4- Imphash
f86759bb4de4320918615dc06e998a39- Authentihash MD5
dd81d5b2343e1976d1708e7eb0649f8f- Authentihash SHA1
c2b8c1b34f09a91efe196f646ef7f9a11190fb8e- Authentihash SHA256
4ee2a56c1592ff0e951b452c0de064eba05b7c98e3add04c8aa3b4a84eb797a5- Machine
- AMD64
- Version
- 3.0
- Publisher
- wj32
Recorded command
sc.exe create krpocesshacker.sys binPath=C:\windows\temp\krpocesshacker.sys type=kernel && sc.exe start krpocesshacker.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html ↗
- https://www.unknowncheats.me/forum/anti-cheat-bypass/312791-bypaph-process-hackers-bypass-read-write-process-virtual-memory-kernel-mem.html#post2315763 ↗
- https://github.com/elastic/protections-artifacts/search?q=VulnDriver ↗