dxgkrnl.sys - Malicious (88/100) - DriverShield Analysis

Analysis of dxgkrnl.sys: malicious verdict, risk score 88/100. 5 YARA matches, 0/75 multi-engine detections. SHA256 7c0c9e8790072ae0. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

dxgkrnl.sys - Analysis Report

DriverShield analyzed the Windows kernel driver dxgkrnl.sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).

Verdict	Malicious (88/100)
YARA matches	5
Multi-engine detections	0 / 75
File size	5191152 bytes
Code-signing signer	Microsoft Windows
Analyzed	2026-06-17
SHA256	7c0c9e8790072ae02e836a3b7f19ca3c9932a930f3b0bef094f23d32d02a61bb
SHA1	b396df9b3445df37d8a039c4f2d971275e1c806e
MD5	7716e2f0724aadd3337d10faa509488a

Driver identity

Version resource data embedded in the dxgkrnl.sys PE header, as extracted by the analysis engine.

File description	DirectX Graphics Kernel
Product	Microsoft® Windows® Operating System
Company	Microsoft Corporation
Original filename	dxgkrnl.sys
Internal name	dxgkrnl.sys
File version	!= NULL
Copyright	© Microsoft Corporation. All rights reserved.

How the 88/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	100 / 100
Dangerous kernel imports	100 / 100
IOCTL dispatch surface	100 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	0 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (54)

Kernel-mode APIs resolved from the Import Address Table of dxgkrnl.sys, ranked by exploitation relevance.

API	Risk	Why it matters
ZwTerminateProcess	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmMapLockedPagesSpecifyCache	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwMapViewOfSection	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmAllocateContiguousMemorySpecifyCache	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwSetSystemInformation	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmAllocateContiguousMemory	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwOpenProcess	high	Potentially dangerous - could be used for privilege escalation or security bypass
HalGetBusDataByOffset	high	Potentially dangerous - could be used for privilege escalation or security bypass
PsSetCreateProcessNotifyRoutineEx	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmGetSystemRoutineAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
HalSetBusDataByOffset	high	Potentially dangerous - could be used for privilege escalation or security bypass
PsLookupProcessByProcessId	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmGetPhysicalAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
KeAttachProcess	high	Potentially dangerous - could be used for privilege escalation or security bypass
ZwSetValueKey	medium	Moderate risk - system modification capability
ZwDeleteFile	medium	Moderate risk - system modification capability
ZwSetInformationFile	medium	Moderate risk - system modification capability
ZwDeleteKey	medium	Moderate risk - system modification capability
ZwWriteFile	medium	Moderate risk - system modification capability
ObOpenObjectByPointer	medium	Moderate risk - system modification capability
KeBugCheckEx	medium	Moderate risk - system modification capability
ZwCreateKey	medium	Moderate risk - system modification capability
ZwQuerySystemInformation	medium	Moderate risk - system modification capability
MmUnmapIoSpace	medium	Moderate risk - system modification capability
ObReferenceObjectByHandle	medium	Moderate risk - system modification capability
IoGetDeviceObjectPointer	medium	Moderate risk - system modification capability
ZwReadFile	low	Standard kernel API - generally benign
ZwQueryValueKey	low	Standard kernel API - generally benign

Showing the 28 highest-relevance imports of 54 resolved.

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x00222000	medium (known exploit)	METHOD_BUFFERED	Driver communication init
0x0080858B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #354
0x00347883	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3616
0x0080808B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #34
0x0022BBFF	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3839
0x00808F8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #994
0x0080B9FF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3711
0x00347B83	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3808
0x00809903	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1600
0x0080878B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #482
0x0080888B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #546
0x0080838B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #226
0x00808B8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #738
0x0080818B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #98
0x0080850F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #323
0x00228307	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #193
0x0022BDB7	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3949
0x0080840F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #259
0x008045C7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #369
0x00806583	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2400
0x0080860F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #387
0x0022E8D3	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #2612
0x00340043	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #16
0x00340033	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #12

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0xA0C5C	0xA1000	6.19	CODE, EXEC, READ
fothk	0x1000	0x1000	0.07	CODE, EXEC, READ
.dxgknpd	0x0075	0x0000	0	READ, WRITE
.rdata	0xB9B60	0xBA000	4.44	IDATA, READ
.data	0x3AF8	0x2000	1.44	IDATA, READ, WRITE
.pdata	0x195F0	0x1A000	6.11	IDATA, READ
.idata	0x5FB2	0x6000	5.11	IDATA, READ
NONPAGE	0x00B0	0x1000	0.05	IDATA, READ, WRITE
PAGE	0x2AF771	0x2B0000	6.36	CODE, EXEC, READ
.edata	0x35B7	0x4000	5.18	IDATA, READ
INIT	0x1ACA	0x2000	5.47	CODE, EXEC, READ, DISCARD
GFIDS	0x2A8C	0x3000	4.68	IDATA, READ, DISCARD
.rsrc	0x965A0	0x97000	4	IDATA, READ
.reloc	0x2079C	0x21000	5.92	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Enforced
Mitigation score	100 / 100

CFG Enabled - Control Flow Guard is active - indirect calls are validated against a bitmap of valid targets at runtime.
ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
Valid Signature - The driver has a valid, non-expired digital signature.
Force Integrity - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY is set - the OS validates the signature before loading.

YARA rule matches (5)

Rule	Severity	Detects
BYOVD_MemRW	critical	Phys memory mapping + device creation
BYOVD_ProcKill	critical	Process termination EDR killer
SUSP_PhysMem	high	Physical memory mapping
SUSP_Callbacks	medium	Kernel callback registration
MAL_EDRKiller	critical	Generic EDR killer pattern

MITRE ATT&CK techniques (19)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1014	Rootkit	Defense Evasion
T1055.001	Process Injection: DLL Injection	Defense Evasion
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1112	Modify Registry	Defense Evasion
T1211	Exploitation for Defense Evasion	Defense Evasion
T1489	Service Stop	Impact
T1542.001	Pre-OS Boot: System Firmware	Persistence
T1543.003	Windows Service	Persistence
T1547.001	Registry Run Keys	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1562.001	Disable/Modify Tools	Defense Evasion
T1562.006	Indicator Blocking	Defense Evasion
T1564.001	Hidden Files and Directories	Defense Evasion
T1569.002	Service Execution	Execution
T1601	Modify System Image	Defense Evasion
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	Microsoft Windows
Signer organisation	Microsoft Corporation
Issuer	Microsoft Windows Production PCA 2011
Serial	330000059B7ABC51A19E71241800000000059B
Valid from	2026-04-16 19:09 UTC
Valid until	2026-10-17 19:09 UTC
Signature validity	Verified

Certificate revision: 0x0200
Certificate type: PKCS#7
Chain: Microsoft Windows Production PCA 2011

Symbolic execution

Engine angr, status static_approximation, 0 paths explored at a maximum depth of 0. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about dxgkrnl.sys

Is dxgkrnl.sys safe?

Based on DriverShield static and dynamic analysis, dxgkrnl.sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.

What is the risk score of dxgkrnl.sys?

dxgkrnl.sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 7c0c9e8790072ae02e836a3b7f19ca3c9932a930f3b0bef094f23d32d02a61bb.

What is dxgkrnl.sys?

dxgkrnl.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Microsoft Windows.