FanControl.sys

[n4skx]

Samples: https://www.virustotal.com/gui/file/11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

Related to WinRing0.sys. Vulnerable functions are few IOCTLs which allows arbitrary memory read and write, and arbitrary msr read and write.

This driver allows:

• Privilege escalation
• EDR/AV tampering
• Arbitrary kernel function calls