SparroWocky loader process with in-memory module load, no new PE

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

Detects the loading of known SparroWocky loader DLLs (winfsp-x64.dll or DukeQt.dll) into a process, followed by the absence of new executable file creation within the same process and time window. This behavior is indicative of in-memory execution techniques, such as Beacon Object File (BOF) loading, aimed at extending implant functionality without writing files to disk.