Driver intelligenceVulnerableVerified

devMemDrv.sys

devMemDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / f375e53d-db7c-4149-beff-c8b9329f6f9bADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

devMemDrv.sysSample 1 · HVCI FALSE

MD5: 63cddb7e887833ecb0aa6c22fe052ed5
SHA1: 96476499a9ffb823af36e47b8f4bdfff78e3f658
SHA256: b93020428f6d9ca700ab70a14911c7efcbcb1f9b659054add0dd3e7657511eb3
Imphash: fd57dbd03df587dcd597b4867774cd83
Authentihash MD5: 1ab964f43e1dabe1ff988eb939dcf369
Authentihash SHA1: 844ccf62a1e9719f12d1b438fd02b1dfc52545b4
Authentihash SHA256: 9a0c3c967acdacd9f89a557cb226420365de4ea0236fd0250d9c00e721b86e0d
Machine: AMD64
Version: 1, 0, 0, 0
Publisher: Acculogic Inc

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create devMemDrv binPath=C:\windows\temp\devMemDrv.sys type=kernel && sc.exe start devMemDrv

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint