rt640x64.sys - Suspicious (35/100) - DriverShield Analysis

Analysis of rt640x64.sys: suspicious verdict, risk score 35/100. 1 YARA match, 0/75 multi-engine detections. SHA256 3af292bcbd169fd3. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

rt640x64.sys - Analysis Report

DriverShield analyzed the Windows kernel driver rt640x64.sys and assigned a verdict of Suspicious with a composite risk score of 35/100, indicating some risk signals warranting review (30-59 band).

Verdict	Suspicious (35/100)
YARA matches	1
Multi-engine detections	0 / 75
File size	1331144 bytes
Code-signing signer	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Analyzed	2026-05-03
SHA256	3af292bcbd169fd3bf1c3cb90d5b7f4649dd2625afc7ed285df249926367186a
SHA1	76cdd4860412da4ea62d2745c84a29a28dffadcd
MD5	4b73b8347f14a3a980e8f5edb1e8ebfe

Driver identity

Version resource data embedded in the rt640x64.sys PE header, as extracted by the analysis engine.

File description	Realtek 8125/8126/8136/8168/8169 NDIS 6.40 64-bit Driver
Product	Realtek 8125/8126/8136/8168/8169 PCI/PCIe Adapters
Company	Realtek
Original filename	rt640x64.sys
Internal name	rt640x64.sys
File version	10.071.0312.2024
Copyright	Copyright (C) 2024 Realtek Semiconductor Corporation. All Rights Reserved.

How the 35/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	30 / 100
Dangerous kernel imports	100 / 100
IOCTL dispatch surface	100 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	0 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (16)

Kernel-mode APIs resolved from the Import Address Table of rt640x64.sys, ranked by exploitation relevance.

API	Risk	Why it matters
MmMapLockedPagesSpecifyCache	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmGetSystemRoutineAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmUnmapIoSpace	medium	Moderate risk - system modification capability
ZwQuerySystemInformation	medium	Moderate risk - system modification capability
ObReferenceObjectByHandle	medium	Moderate risk - system modification capability
IoGetDeviceObjectPointer	medium	Moderate risk - system modification capability
IofCompleteRequest	low	Standard kernel API - generally benign
RtlInitUnicodeString	low	Standard kernel API - generally benign
KeInitializeEvent	low	Standard kernel API - generally benign
KeWaitForSingleObject	low	Standard kernel API - generally benign
ExAllocatePoolWithTag	low	Standard kernel API - generally benign
ZwQueryValueKey	low	Standard kernel API - generally benign
ZwClose	low	Standard kernel API - generally benign
DbgPrintEx	low	Standard kernel API - generally benign
KeSetEvent	low	Standard kernel API - generally benign
ZwOpenKey	low	Standard kernel API - generally benign

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x00807FA3	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #4072
0x00807FAB	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #4074
0x00802093	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2084
0x00807FBB	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #4078
0x008020BB	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2094
0x008039A3	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3688
0x00803C83	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3872
0x00803D83	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3936
0x00803883	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3616
0x0080DFB3	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2028
0x00809CB3	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1836
0x0080D0B7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1069
0x0080C7FF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #511
0x00807087	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3105
0x0080BDBF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3951
0x0080A3B7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2285
0x0080840F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #259
0x0080F0B7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3117
0x0080BDAF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3947
0x0080A9A7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2665
0x0080F0BF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3119
0x008090A7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1065
0x00801CA7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1833
0x0080A9BB	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2670

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0x11DE84	0x11E000	6.22	CODE, EXEC, READ
.rdata	0x1744C	0x17600	5.61	IDATA, READ
.data	0x1CC0	0x1A00	2.52	IDATA, READ, WRITE
.pdata	0x34A4	0x3600	5.78	IDATA, READ
PAGE	0x072C	0x0800	5.68	CODE, EXEC, READ
INIT	0x1632	0x1800	5.52	CODE, EXEC, READ, DISCARD
.rsrc	0x0680	0x0800	2.79	IDATA, READ, DISCARD
.reloc	0x2C6C	0x2E00	6.01	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Not enforced
Mitigation score	100 / 100

CFG Enabled - Control Flow Guard is active - indirect calls are validated against a bitmap of valid targets at runtime.
ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
Valid Signature - The driver has a valid, non-expired digital signature.

YARA rule matches (1)

Rule	Severity	Detects
SUSP_PhysMem	high	Physical memory mapping

MITRE ATT&CK techniques (11)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1112	Modify Registry	Defense Evasion
T1211	Exploitation for Defense Evasion	Defense Evasion
T1543.003	Windows Service	Persistence
T1547.001	Registry Run Keys	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1569.002	Service Execution	Execution
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Signer organisation	DigiCert, Inc.
Issuer	DigiCert Trusted Root G4
Serial	8AD40B260D29C4C9F5ECDA9BD93AED9
Valid from	2021-04-29 00:00 UTC
Valid until	2036-04-28 23:59 UTC
Signature validity	Verified

Certificate revision: 0x0200
Certificate type: PKCS#7
Chain: Realtek Semiconductor Corp.

Symbolic execution

Engine angr, status completed, 54 paths explored at a maximum depth of 54. Vulnerability classes reached: 0. Exploitable paths: 4.

Frequently asked questions about rt640x64.sys

Is rt640x64.sys safe?

Based on DriverShield static and dynamic analysis, rt640x64.sys shows some suspicious signals and warrants manual review. Its composite risk score is 35/100 (verdict: suspicious). Always validate findings independently before acting.

What is the risk score of rt640x64.sys?

rt640x64.sys has a DriverShield composite risk score of 35/100, placing it in the suspicious verdict band. SHA256: 3af292bcbd169fd3bf1c3cb90d5b7f4649dd2625afc7ed285df249926367186a.

What is rt640x64.sys?

rt640x64.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1.