4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe
Size 239KB
Sample260511-msd3eaaz2r
SHA256 4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0
MD5 098873c4d1a870ee498e6c9fcdbbb461
SHA1 69f352e651021ec9ff41cd3200622992a0ea6b94
SHA512 1a5443bba32fe8212b12d812ebb87f465cf28e19e56e6774a2ff461a669fabfb7cb900fa2ae496520b51785e0b15d2e047fd6d3674ed7cf35588a6b0a34d2760
SSDEEP 6144:FEyBJtmNllRR9Bihsc5JGxIrJdrCa42gnuOG:FEyBnAMhsc5JGxurCa4c
TLSH
T1B5346B5B73E520FAE0778639C8A3094AD772B83107619BAF03A4465A1F277D19D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	840	Rundll32.exe
3	840	Rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svzamx_service\Parameters\ServiceDll = "C:\\Users\\Public\\Videos\\svzamx_s.dll"	4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe

Loads dropped DLL 2 IoCs

pid	Process
2036	svchost.exe
840	Rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Rundll32.exe	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe
840	Rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 840	2036	svchost.exe	81

C:\Users\Admin\AppData\Local\Temp\4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe
"C:\Users\Admin\AppData\Local\Temp\4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe"
1⤵
- Server Software Component: Terminal Services DLL
PID:4808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
PID:788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\Rundll32.exe
  C:\Windows\system32\Rundll32.exe "c:\users\public\videos\svzamx_s.dll",MainThread
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svzamx_service"
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a78154765e74863edd44da4154c3bc6

Path C:\Users\Public\Documents\8a78154765e74863edd44da4154c3bc6
Size 162B
SHA256 d8ef7e0f3922e473c287e1071997febb5c78c07c1aef5546b3fa0e47590d3b6f
MD5 3b9e71dcc07bb6175560997f0c3e5fae
SHA1 7e126b52cbd1da1a7fd1ca9291fc788ad56c6368
SHA512 fd932c3f951315c417783a056e0d3c0a4b12d465f534abed34e3aeff008521b456add15d6e5c1a0d70a2b0211ffeb9bca797260386f177e584d9ae4c6fc7d131
TLSH
T10CC08CEC96C0F96C3C89F054E088F20C0D4665D6B4718E210C08AA2F2623094864480F
MD5 SHA1 SHA512 TLSH

Submit Download

svzamx_s.dll

Path \??\c:\users\public\videos\svzamx_s.dll
Size 108KB
SHA256 f320126fca30ca72fd4d7755adaed6e43b2937604e143840a35775aabfcb7742
MD5 29736dc04cb7c62d02faf75a45faa2f0
SHA1 a22d04bb51e69e7373a6e175ceddfc7f89cb059d
SHA512 87b3c7bb66c73003ede24fa12345a243ca92cf6e34f96142d1338e43cb74daa8129815022f0a62b6de7b93f125c18480e56321c1b7a6619fe714426a5cd7daac
SSDEEP 3072:7hscwwLJGVzIyj/aA0drCakJtNdUNtlFAhBLIt3wuuuOvDl:7hsc5JGxIrJdrCa42gnuO
TLSH
T1AFB35C5767A500BBE1B78238C8A3494AD772B8500761AFEF43A0468E1F677D19D3DF21
MD5 SHA1 SHA512 SSDEEP TLSH