Netwtw14.sys - Vulnerable (72/100) - DriverShield Analysis

Analysis of Netwtw14.sys: vulnerable verdict, risk score 72/100. 0 YARA matches, 0/76 multi-engine detections. SHA256 660ef8f59f3b2ff0. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

Netwtw14.sys - Analysis Report

DriverShield analyzed the Windows kernel driver Netwtw14.sys and assigned a verdict of Vulnerable with a composite risk score of 72/100, indicating a known or likely vulnerability surface (60-79 band).

Verdict	Vulnerable (72/100)
YARA matches	0
Multi-engine detections	0 / 76
File size	5566368 bytes
Code-signing signer	Sectigo Public Code Signing Root R46
Analyzed	2026-04-03
SHA256	660ef8f59f3b2ff0454e27a8449ac7d3c00c983a04d44762acde717489d62121
SHA1	ebb5dfcb2c571ba2b1ed33ae69ed756498514466
MD5	9c8198bb0504bb77a664829a47e477af

Driver identity

Version resource data embedded in the Netwtw14.sys PE header, as extracted by the analysis engine.

File description	R Intel Wireless WiFi Link Driver
Product	Intel® Wireless WiFi Link Adapter
Company	Intel Corporation
Original filename	Netwtw14.sys
Internal name	Netwtw14.sys
File version	23.50.12.1
Copyright	Copyright (C) 2025 Intel Corporation

How the 72/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	0 / 100
Dangerous kernel imports	100 / 100
IOCTL dispatch surface	100 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	0 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (19)

Kernel-mode APIs resolved from the Import Address Table of Netwtw14.sys, ranked by exploitation relevance.

API	Risk	Why it matters
MmMapLockedPagesSpecifyCache	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmGetSystemRoutineAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
IoGetDeviceObjectPointer	medium	Moderate risk - system modification capability
ZwQuerySystemInformation	medium	Moderate risk - system modification capability
KeBugCheckEx	medium	Moderate risk - system modification capability
ZwWriteFile	medium	Moderate risk - system modification capability
ExAllocatePoolWithTag	low	Standard kernel API - generally benign
KeInitializeEvent	low	Standard kernel API - generally benign
ZwQueryValueKey	low	Standard kernel API - generally benign
ZwClose	low	Standard kernel API - generally benign
DbgPrintEx	low	Standard kernel API - generally benign
RtlInitUnicodeString	low	Standard kernel API - generally benign
ZwReadFile	low	Standard kernel API - generally benign
KeSetEvent	low	Standard kernel API - generally benign
ZwOpenFile	low	Standard kernel API - generally benign
ZwOpenKey	low	Standard kernel API - generally benign
ZwQueryInformationFile	low	Standard kernel API - generally benign
KeWaitForSingleObject	low	Standard kernel API - generally benign
IoBuildDeviceIoControlRequest	low	Standard kernel API - generally benign

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x0022201C	critical (known exploit)	METHOD_BUFFERED	Process termination by PID (wsftprm)
0x0080840F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #259
0xC350408B	high	METHOD_NEITHER	CUSTOM_MSI Function #34
0x0080808B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #34
0x0080A88B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2594
0x00808B8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #738
0x0080878B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #482
0x0080868B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #418
0x00808F8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #994
0x0034BAFF	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3775
0x008086C7	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #433
0x0080B883	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3616
0xC350418B	high	METHOD_NEITHER	CUSTOM_MSI Function #98
0x0080B82B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3594
0x0080E9FF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2687
0x0080B08B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3106
0x0080888B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #546
0x00809103	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1088
0x0080818B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #98
0x00347B83	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3808
0x0080890F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #579
0x0080003F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #15
0x0080830F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #195
0x0080B88B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #3618

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0x3CBED7	0x3CC000	6.36	CODE, EXEC, READ
.rdata	0x9DC78	0x9DE00	5.67	IDATA, READ
.data	0xC4D90	0x4D600	1.91	IDATA, READ, WRITE
.pdata	0x2D8E8	0x2DA00	6.31	IDATA, READ
PAGEcsrv	0xA782	0xA800	6.23	CODE, EXEC, READ
PAGE	0x22C1	0x2400	5.96	CODE, EXEC, READ
PAGEcsec	0x000E	0x0200	0.26	CODE, EXEC, READ
PAGEcjaw	0x0DC0	0x0E00	6.35	CODE, EXEC, READ
PAGEcwfd	0x12091	0x12200	6.4	CODE, EXEC, READ
PAGEcimg	0x253C	0x2600	6.42	CODE, EXEC, READ
PAGEccln	0xEC59	0xEE00	6.24	CODE, EXEC, READ
PAGEcsv_	0x49E3	0x4A00	6.24	CODE, EXEC, READ
PAGEcctw	0x0141	0x0200	4.15	CODE, EXEC, READ
PAGEdoid	0x2E40	0x3000	3.12	IDATA, READ, WRITE
PAGEdcln	0x0EB0	0x1000	2.36	IDATA, READ, WRITE
PAGEdSlr	0x1298	0x1400	1.83	IDATA, READ, WRITE
PAGEdMag	0x12C0	0x1400	1.84	IDATA, READ, WRITE
PAGEdBla	0x12D0	0x1400	1.87	IDATA, READ, WRITE
PAGEdHrp	0x0140	0x0200	1.2	IDATA, READ, WRITE
PAGEdGfp	0x0258	0x0400	1.16	IDATA, READ, WRITE
PAGEdMrp	0x01E0	0x0200	1.72	IDATA, READ, WRITE
PAGEdFmp	0x0280	0x0400	1.24	IDATA, READ, WRITE
PAGEdWhp	0x0280	0x0400	1.24	IDATA, READ, WRITE
PAGEdSim	0x0048	0x0200	0.39	IDATA, READ, WRITE
PAGEdFpg	0x0078	0x0200	0.66	IDATA, READ, WRITE
PAGEdSle	0x0070	0x0200	0.63	IDATA, READ, WRITE
PAGEdreg	0xF54C	0xF600	2.39	IDATA, READ, WRITE
PAGEdimg	0x05D0	0x0600	5.07	IDATA, READ, WRITE
PAGEdsv_	0x0038	0x0200	0.2	IDATA, READ, WRITE
PAGEdjaw	0x0014	0x0200	0	IDATA, READ, WRITE
INIT	0x1652	0x1800	5.03	CODE, EXEC, READ, DISCARD
.rsrc	0xB848	0xBA00	4.97	IDATA, READ, DISCARD
.reloc	0x85C0	0x8600	5.46	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Enforced
Mitigation score	100 / 100

• CFG Enabled - Control Flow Guard is active - indirect calls are validated against a bitmap of valid targets at runtime.
• ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
• DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
• Valid Signature - The driver has a valid, non-expired digital signature.
• Force Integrity - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY is set - the OS validates the signature before loading.

MITRE ATT&CK techniques (10)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1112	Modify Registry	Defense Evasion
T1211	Exploitation for Defense Evasion	Defense Evasion
T1543.003	Windows Service	Persistence
T1547.001	Registry Run Keys	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	Sectigo Public Code Signing Root R46
Signer organisation	Sectigo Limited
Issuer	AAA Certificate Services
Serial	48FC93B46055948D36A7C98A89D69416
Valid from	2021-05-25 00:00 UTC
Valid until	2028-12-31 23:59 UTC
Signature validity	Verified

• Certificate revision: 0x0200
• Certificate type: PKCS#7
• Chain: Sectigo Public Time Stamping CA R36
• Chain: Sectigo Public Code Signing CA EV R36
• Chain: Intel Corporation
• Chain: Sectigo Public Time Stamping Signer R36
• Chain: Sectigo Public Time Stamping Root R46

Symbolic execution

Engine angr, status completed, 100 paths explored at a maximum depth of 100. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about Netwtw14.sys

Is Netwtw14.sys safe?

Based on DriverShield static and dynamic analysis, Netwtw14.sys is flagged as vulnerable and is a potential Bring Your Own Vulnerable Driver (BYOVD) risk. Its composite risk score is 72/100 (verdict: vulnerable). Always validate findings independently before acting.

What is the risk score of Netwtw14.sys?

Netwtw14.sys has a DriverShield composite risk score of 72/100, placing it in the vulnerable verdict band. SHA256: 660ef8f59f3b2ff0454e27a8449ac7d3c00c983a04d44762acde717489d62121.

What is Netwtw14.sys?

Netwtw14.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Sectigo Public Code Signing Root R46.

Related: Other drivers signed by Sectigo Public Code Signing Root R46 · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas

---

DriverShield © 2025-2026 · Terms · Privacy · Contact