← Back to driver explorer
Driver intelligenceVulnerableVerified
physmem.sys
Description not recorded.
Known samples 2
1 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
physmem.sysSample 1 · HVCI TRUE
- SHA1
589a7d4df869395601ba7538a65afae8c4616385- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
physmem.sysSample 2 · HVCI FALSE
- MD5
a0e2223868b6133c5712ba5ed20c3e8a- SHA1
17614fdee3b89272e99758983b99111cbb1b312c- SHA256
c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d- Imphash
e5af2438da6df2aa9750aa632c80cfa4- Authentihash MD5
f2cd816e7f899442730b832a2e03797e- Authentihash SHA1
fd0cb3ea1deb4fdb22536a7c15669eb53315e5c8- Authentihash SHA256
03a831e18d933954d432187835e0d6aea8bf10fd84dfbe36a23366e2b0538a11- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Hilscher Gesellschaft für Systemaoutomation mbH
Recorded command
sc.exe create physmem.sys binPath=C:\windows\temp\physmem.sys type=kernel && sc.exe start physmem.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: hfiref0x hfiref0x