d17e5d5369b66e8eecbca1aa7a56ac37b35a35a6420b7fd2921ae27fd6207fdb

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 00:33

Target
stlvault-win-0.5.1/StlVault.exe
Size 635KB
Sample260710-awa4pscw2w
SHA256 d17e5d5369b66e8eecbca1aa7a56ac37b35a35a6420b7fd2921ae27fd6207fdb
MD5 76d756e951f7548579d86272c1d95d21
SHA1 b07a65b1ff1890b9c0bfe2d231e5ffd94cfd383d
SHA512 3353b19ad2e122a4084aacc205f874b97f9ed4f465d3dbfacff3b3c2d06d30878dc53cb2d67351d338921c33ef0935e65392a3ce31ec80782243d242dd1796c3
SSDEEP 3072:wys7oYfSbbQTLWuiUg7VsS4jMbN0iVls:w/7oYfSHQPWTUg4dus
TLSH
T147D42B7C615890BEC0EBCE3A6C5171C67261AEF01B92F6FAF14CF74919F315B881162A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	StlVault.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\GameAssembly.pdb	StlVault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4840	StlVault.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4032	4840	StlVault.exe	83

C:\Users\Admin\AppData\Local\Temp\stlvault-win-0.5.1\StlVault.exe
"C:\Users\Admin\AppData\Local\Temp\stlvault-win-0.5.1\StlVault.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\stlvault-win-0.5.1\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\stlvault-win-0.5.1\UnityCrashHandler64.exe" --attach 4840 2796871356416
  2⤵
  PID:4032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x404
1⤵
PID:2212