werkernel.sys - Clean (26/100) - DriverShield Analysis

Analysis of werkernel.sys: clean verdict, risk score 26/100. 0 YARA matches. SHA256 30567141831f9990. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

werkernel.sys - Analysis Report

DriverShield analyzed the Windows kernel driver werkernel.sys and assigned a verdict of Clean with a composite risk score of 26/100, indicating no notable risk signals (0-29 band).

VerdictClean (26/100)
YARA matches0
File size54664 bytes
Code-signing signerMicrosoft Windows
Analyzed2026-03-22
SHA25630567141831f99903fec271f51d98b9111b8d70cd0c2ae204f7d6e2463006a91
SHA11f30fb6fc1b2ced834c65428c3a44600b96821fa
MD5e36eaa6b26eb83ff3f8129cb96dd746d

Driver identity

Version resource data embedded in the werkernel.sys PE header, as extracted by the analysis engine.

File descriptionWindows Error Reporting Kernel Driver
ProductMicrosoft® Windows® Operating System
CompanyMicrosoft Corporation
Original filenamewerkernel.sys
Internal namewerkernel
File version10.0.19041.4474 (WinBuild.160101.0800)
Copyright© Microsoft Corporation. All rights reserved.

How the 26/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches0 / 100
Dangerous kernel imports100 / 100
IOCTL dispatch surface27 / 100
Known-vulnerable corpus0 / 100
Code-signing state80 / 100
Packing and entropy0 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

Kernel imports (13)

Kernel-mode APIs resolved from the Import Address Table of werkernel.sys, ranked by exploitation relevance.

APIRiskWhy it matters
ZwMapViewOfSectioncriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwSetValueKeymediumModerate risk - system modification capability
ZwCreateKeymediumModerate risk - system modification capability
ObReferenceObjectByHandlemediumModerate risk - system modification capability
ZwQuerySystemInformationmediumModerate risk - system modification capability
ZwDeleteKeymediumModerate risk - system modification capability
ZwQueryValueKeylowStandard kernel API - generally benign
RtlInitUnicodeStringlowStandard kernel API - generally benign
ZwOpenFilelowStandard kernel API - generally benign
ExAllocatePoolWithTaglowStandard kernel API - generally benign
DbgPrintExlowStandard kernel API - generally benign
ZwCloselowStandard kernel API - generally benign
ZwOpenKeylowStandard kernel API - generally benign

IOCTL dispatch codes (9)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x0080858BhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #354
0x002200F0mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #60
0x0022011CmediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #71
0x0080E281mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2208
0x0080EC81mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2848
0x0080249CmediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2343
0x0034E045mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #2065
0x003403B4mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #237
0x0034002EmediumMETHOD_OUT_DIRECTFILE_DEVICE_DISK Function #11

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0x0CA90x0E005.78CODE, EXEC, READ
.rdata0x30000x30005.27IDATA, READ
.data0x03200x04000.73IDATA, READ, WRITE
.pdata0x03300x04003.58IDATA, READ
.idata0x09B60x0A004.4IDATA, READ
PAGE0x3FFF0x40006.17CODE, EXEC, READ
.edata0x01490x02003.5IDATA, READ
INIT0x0BF20x0C006.16CODE, EXEC, READ, DISCARD
GFIDS0x003C0x02000.59IDATA, READ, DISCARD
.rsrc0x04180x06002.51IDATA, READ, DISCARD
.reloc0x04C00x06004.29IDATA, READ, DISCARD

Exploit mitigations

Control Flow GuardEnabled
ASLREnabled
DEPEnabled
Integrity checkNot enforced
Mitigation score85 / 100

MITRE ATT&CK techniques (11)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1003.001OS Credential Dumping: LSASS MemoryCredential Access
T1055.012Process HollowingDefense Evasion
T1068Exploitation for Privilege EscalationPrivilege Escalation
T1071Application Layer ProtocolCommand and Control
T1112Modify RegistryDefense Evasion
T1211Exploitation for Defense EvasionDefense Evasion
T1543.003Windows ServicePersistence
T1547.001Registry Run KeysPersistence
T1553.002Subvert Trust Controls: Code SigningDefense Evasion
T1569.002System Services: Service ExecutionExecution
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerMicrosoft Windows
Signer organisationMicrosoft Corporation
IssuerMicrosoft Windows Production PCA 2011
Serial330000045FF3C96C1A7FF7DA1D00000000045F
Valid from2023-11-16 19:20 UTC
Valid until2024-11-14 19:20 UTC (expired)
Signature validityNot verified

Symbolic execution

Engine angr, status no_findings, 0 paths explored at a maximum depth of 0. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about werkernel.sys

Is werkernel.sys safe?

Based on DriverShield static and dynamic analysis, werkernel.sys is assessed as clean, with no notable risk signals. Its composite risk score is 26/100 (verdict: clean). Always validate findings independently before acting.

What is the risk score of werkernel.sys?

werkernel.sys has a DriverShield composite risk score of 26/100, placing it in the clean verdict band. SHA256: 30567141831f99903fec271f51d98b9111b8d70cd0c2ae204f7d6e2463006a91.

What is werkernel.sys?

werkernel.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Microsoft Windows.

Related: Other drivers signed by Microsoft Windows · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas


DriverShield © 2025-2026 · Terms · Privacy · Contact