d17e5d5369b66e8eecbca1aa7a56ac37b35a35a6420b7fd2921ae27fd6207fdb

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 00:33

Target
stlvault-win-0.5.1/StlVault.exe
Size 635KB
Sample260710-awa4pscw2w
SHA256 d17e5d5369b66e8eecbca1aa7a56ac37b35a35a6420b7fd2921ae27fd6207fdb
MD5 76d756e951f7548579d86272c1d95d21
SHA1 b07a65b1ff1890b9c0bfe2d231e5ffd94cfd383d
SHA512 3353b19ad2e122a4084aacc205f874b97f9ed4f465d3dbfacff3b3c2d06d30878dc53cb2d67351d338921c33ef0935e65392a3ce31ec80782243d242dd1796c3
SSDEEP 3072:wys7oYfSbbQTLWuiUg7VsS4jMbN0iVls:w/7oYfSHQPWTUg4dus
TLSH
T147D42B7C615890BEC0EBCE3A6C5171C67261AEF01B92F6FAF14CF74919F315B881162A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	StlVault.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	StlVault.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\ntdll.pdb	StlVault.exe
File opened for modification	C:\Windows\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\dll\GameAssembly.pdb	StlVault.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_il2cpp_x64.pdb	StlVault.exe
File opened for modification	C:\Windows\kernel32.pdb	StlVault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5184	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	StlVault.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4644	624	StlVault.exe	86
PID 4644 wrote to memory of 2820	4644	UnityCrashHandler64.exe	92

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004FC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5184