← Back to driver explorer
Driver intelligenceVulnerableVerified
termdd.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
termdd.sysSample 1 · HVCI unknown
- MD5
561e7e1f06895d78de991e01dd0fb6e5- SHA1
f7089f6d7bb2b386e932aec5211689ea85fde9cc- SHA256
83bfa50a528762ec52a011302ac3874636fb7e26628cd7acfbf2bdc9faa8110d- Imphash
41d9c23e4e5fb4ef7e7c2e595a30251b- Authentihash MD5
9e1202c1932c71f3c2f09f57ac80e74d- Authentihash SHA1
e91d27a2a039ca8f55cc01ae81b285a99d6d6420- Authentihash SHA256
ba75dd2c8f585b327086b1e8104093a41ccd2b8a87f08b1c43027baa2e3a0ded- Machine
- AMD64
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
- Publisher
- Microsoft Corporation
Recorded command
sc.exe create termdd.sys binPath=C:\windows\temp\termdd.sys type=kernel && sc.exe start termdd.sysCode Integrity Tampering · Privileges: Admin privileges · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani @mnznndr97