4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe
Size 239KB
Sample260511-msd3eaaz2r
SHA256 4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0
MD5 098873c4d1a870ee498e6c9fcdbbb461
SHA1 69f352e651021ec9ff41cd3200622992a0ea6b94
SHA512 1a5443bba32fe8212b12d812ebb87f465cf28e19e56e6774a2ff461a669fabfb7cb900fa2ae496520b51785e0b15d2e047fd6d3674ed7cf35588a6b0a34d2760
SSDEEP 6144:FEyBJtmNllRR9Bihsc5JGxIrJdrCa42gnuOG:FEyBnAMhsc5JGxurCa4c
TLSH
T1B5346B5B73E520FAE0778639C8A3094AD772B83107619BAF03A4465A1F277D19D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4528	Rundll32.exe
8	4528	Rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svzamx_service\Parameters\ServiceDll = "C:\\Users\\Public\\Videos\\svzamx_s.dll"	4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe

Loads dropped DLL 2 IoCs

pid	Process
4444	svchost.exe
4528	Rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Rundll32.exe	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4528	4444	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe
"C:\Users\Admin\AppData\Local\Temp\4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe"
1⤵
- Server Software Component: Terminal Services DLL
PID:3216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
PID:4600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\system32\Rundll32.exe
  C:\Windows\system32\Rundll32.exe "c:\users\public\videos\svzamx_s.dll",MainThread
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a78154765e74863edd44da4154c3bc6

Path C:\Users\Public\Documents\8a78154765e74863edd44da4154c3bc6
Size 162B
SHA256 141d7d4c1a2aff5219b684026227bc890ced98d11b52728185f09122212e4e36
MD5 4f215acd10bc216077f024ed6aa45140
SHA1 a4253290876f3dc4feca2f5adf3672f2e781c0d9
SHA512 2b972c427b264fcb8f83c29c1c3e1ab1ad3550c79441a837bd537467da6e724eac59589e30d13c1aa70e2ae675ada5149af2c473b2f5417a127ab7cc50af642b
TLSH
T1A3C08CFC0DC0B53C2CC8A420D7CAF1080087B9E4B056AE610824752A39D3458C30888F
MD5 SHA1 SHA512 TLSH

Submit Download

svzamx_s.dll

Path \??\c:\users\public\videos\svzamx_s.dll
Size 108KB
SHA256 f320126fca30ca72fd4d7755adaed6e43b2937604e143840a35775aabfcb7742
MD5 29736dc04cb7c62d02faf75a45faa2f0
SHA1 a22d04bb51e69e7373a6e175ceddfc7f89cb059d
SHA512 87b3c7bb66c73003ede24fa12345a243ca92cf6e34f96142d1338e43cb74daa8129815022f0a62b6de7b93f125c18480e56321c1b7a6619fe714426a5cd7daac
SSDEEP 3072:7hscwwLJGVzIyj/aA0drCakJtNdUNtlFAhBLIt3wuuuOvDl:7hsc5JGxIrJdrCa42gnuO
TLSH
T1AFB35C5767A500BBE1B78238C8A3494AD772B8500761AFEF43A0468E1F677D19D3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4528-19-0x000001C7556C0000-0x000001C755709000-memory.dmp

Download

memory/4528-18-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-5-0x000001C7556C0000-0x000001C755709000-memory.dmp

Download

memory/4528-15-0x000001C756130000-0x000001C756139000-memory.dmp

Download

memory/4528-16-0x000001C756130000-0x000001C756139000-memory.dmp

Download

memory/4528-17-0x000001C756130000-0x000001C756139000-memory.dmp

Download

memory/4528-4-0x000001C755200000-0x000001C755201000-memory.dmp

Download

memory/4528-6-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-20-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-21-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-22-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-25-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-28-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download

memory/4528-31-0x00007FFF05A50000-0x00007FFF05EC2000-memory.dmp

Download