dxgkrnl.sys - Malicious (88/100) - DriverShield Analysis

Analysis of dxgkrnl.sys: malicious verdict, risk score 88/100. 5 YARA matches, 0/75 multi-engine detections. SHA256 56840be15222f5b1. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

dxgkrnl.sys - Analysis Report

DriverShield analyzed the Windows kernel driver dxgkrnl.sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).

Verdict	Malicious (88/100)
YARA matches	5
Multi-engine detections	0 / 75
File size	5178912 bytes
Code-signing signer	Microsoft Windows
Analyzed	2026-04-03
SHA256	56840be15222f5b16065642db29766f13fec57ffa1c98397865245a21dc63280
SHA1	bdc03fdfbe4c09cafaa795d5bb3ff27cfa4b5bd5
MD5	8dbd22423b50159b69bf75c5f6676727

Driver identity

Version resource data embedded in the dxgkrnl.sys PE header, as extracted by the analysis engine.

File description	DirectX Graphics Kernel
Product	Microsoft® Windows® Operating System
Company	Microsoft Corporation
Original filename	dxgkrnl.sys
Internal name	dxgkrnl.sys
File version	!= NULL
Copyright	© Microsoft Corporation. All rights reserved.

How the 88/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	100 / 100
Dangerous kernel imports	100 / 100
IOCTL dispatch surface	100 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	0 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (54)

Kernel-mode APIs resolved from the Import Address Table of dxgkrnl.sys, ranked by exploitation relevance.

API	Risk	Why it matters
ZwTerminateProcess	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmMapLockedPagesSpecifyCache	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwMapViewOfSection	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmAllocateContiguousMemory	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmGetSystemRoutineAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwSetSystemInformation	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmAllocateContiguousMemorySpecifyCache	high	Potentially dangerous - could be used for privilege escalation or security bypass
KeAttachProcess	high	Potentially dangerous - could be used for privilege escalation or security bypass
PsLookupProcessByProcessId	high	Potentially dangerous - could be used for privilege escalation or security bypass
HalGetBusDataByOffset	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmGetPhysicalAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwOpenProcess	high	Potentially dangerous - could be used for privilege escalation or security bypass
PsSetCreateProcessNotifyRoutineEx	high	Potentially dangerous - could be used for privilege escalation or security bypass
HalSetBusDataByOffset	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwDeleteKey	medium	Moderate risk - system modification capability
MmUnmapIoSpace	medium	Moderate risk - system modification capability
ZwWriteFile	medium	Moderate risk - system modification capability
KeBugCheckEx	medium	Moderate risk - system modification capability
ZwSetValueKey	medium	Moderate risk - system modification capability
ZwSetInformationFile	medium	Moderate risk - system modification capability
IoGetDeviceObjectPointer	medium	Moderate risk - system modification capability
ObReferenceObjectByHandle	medium	Moderate risk - system modification capability
ZwQuerySystemInformation	medium	Moderate risk - system modification capability
ZwCreateKey	medium	Moderate risk - system modification capability
ObOpenObjectByPointer	medium	Moderate risk - system modification capability
ZwDeleteFile	medium	Moderate risk - system modification capability
ProbeForWrite	low	Standard kernel API - generally benign
KeInitializeEvent	low	Standard kernel API - generally benign

Showing the 28 highest-relevance imports of 54 resolved.

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x00222000	medium (known exploit)	METHOD_BUFFERED	Driver communication init
0x0080858B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #354
0x00347883	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3616
0x0022BBFF	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3839
0x00340013	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #4
0x00808F8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #994
0x0080998B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1634
0x0080B9FF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3711
0x00347B83	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3808
0x00809903	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1600
0x0080878B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #482
0x0080888B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #546
0x0080838B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #226
0x00808B8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #738
0x0080818B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #98
0x0080850F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #323
0x00228307	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #193
0x0022BDB7	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3949
0x0080840F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #259
0x0022E83B	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #2574
0x008045C7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #369
0x00806583	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2400
0x0080860F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #387
0x0080808B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #34

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0xA0EDC	0xA1000	6.2	CODE, EXEC, READ
fothk	0x1000	0x1000	0.07	CODE, EXEC, READ
.dxgknpd	0x0075	0x0000	0	READ, WRITE
.rdata	0xB8FB0	0xB9000	4.44	IDATA, READ
.data	0x3BB8	0x2000	1.43	IDATA, READ, WRITE
.pdata	0x1959C	0x1A000	6.11	IDATA, READ
.idata	0x5F90	0x6000	5.1	IDATA, READ
NONPAGE	0x00B0	0x1000	0.04	IDATA, READ, WRITE
PAGE	0x2ADF05	0x2AE000	6.36	CODE, EXEC, READ
.edata	0x34AE	0x4000	5.16	IDATA, READ
INIT	0x1AF6	0x2000	5.54	CODE, EXEC, READ, DISCARD
GFIDS	0x2A50	0x3000	4.68	IDATA, READ, DISCARD
.rsrc	0x96490	0x97000	4	IDATA, READ
.reloc	0x20658	0x21000	5.91	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Enforced
Mitigation score	100 / 100

CFG Enabled - Control Flow Guard is active - indirect calls are validated against a bitmap of valid targets at runtime.
ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
Valid Signature - The driver has a valid, non-expired digital signature.
Force Integrity - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY is set - the OS validates the signature before loading.

YARA rule matches (5)

Rule	Severity	Detects
BYOVD_MemRW	critical	Phys memory mapping + device creation
BYOVD_ProcKill	critical	Process termination EDR killer
SUSP_PhysMem	high	Physical memory mapping
SUSP_Callbacks	medium	Kernel callback registration
MAL_EDRKiller	critical	Generic EDR killer pattern

MITRE ATT&CK techniques (19)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1014	Rootkit	Defense Evasion
T1055.001	Process Injection: DLL Injection	Defense Evasion
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1112	Modify Registry	Defense Evasion
T1211	Exploitation for Defense Evasion	Defense Evasion
T1489	Service Stop	Impact
T1542.001	Pre-OS Boot: System Firmware	Persistence
T1543.003	Windows Service	Persistence
T1547.001	Registry Run Keys	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1562.001	Disable/Modify Tools	Defense Evasion
T1562.006	Indicator Blocking	Defense Evasion
T1564.001	Hidden Files and Directories	Defense Evasion
T1569.002	Service Execution	Execution
T1601	Modify System Image	Defense Evasion
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	Microsoft Windows
Signer organisation	Microsoft Corporation
Issuer	Microsoft Windows Production PCA 2011
Serial	3300000518418419ADCBAD294F000000000518
Valid from	2025-06-19 18:11 UTC
Valid until	2026-06-17 18:11 UTC
Signature validity	Verified

Certificate revision: 0x0200
Certificate type: PKCS#7
Chain: Microsoft Windows Production PCA 2011

Symbolic execution

Engine angr, status static_approximation, 0 paths explored at a maximum depth of 0. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about dxgkrnl.sys

Is dxgkrnl.sys safe?

Based on DriverShield static and dynamic analysis, dxgkrnl.sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.

What is the risk score of dxgkrnl.sys?

dxgkrnl.sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 56840be15222f5b16065642db29766f13fec57ffa1c98397865245a21dc63280.

What is dxgkrnl.sys?

dxgkrnl.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Microsoft Windows.