daec3ebd49b3d83edf3dddf9cd49405699db14a3452a91607813a9c738d5d14a

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 18:44

Target
krypton-client-1.21.11.jar
Size 5.2MB
Sample260627-xdpkpsds6p
SHA256 daec3ebd49b3d83edf3dddf9cd49405699db14a3452a91607813a9c738d5d14a
MD5 55570aada409cc35a67d6ca920b481a8
SHA1 3c8a6e6e682ada13f3cb45022dea0e0f8e74e17b
SHA512 d615c9beb73f181b1d8b7af18afdc4f30ce953fd1861ab81919001abcaa7b19437a2b871d97ff459b3beab5f5f36afc8cfaca47087076c8c9c6c53d1ea3731c7
SSDEEP 98304:3KvPT1CUq/V8xnOcGrPASUiidXGTQ3MZx8NJkICwlPuZLBLAGhbMj:04fVsOpzVUiiAMcj0HCwlPABLANj
TLSH
T13A46337356119B864882B5950B607527E65329DB7708E92838A52FFC9CCBD03C7FE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5600	ShellHost.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\krypton-client-1.21.11.jar
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D0
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4340

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5600

memory/4368-2-0x000001F01E3F0000-0x000001F01E660000-memory.dmp

Download

memory/4368-12-0x000001F01CB70000-0x000001F01CB71000-memory.dmp

Download

memory/4368-13-0x000001F01E3F0000-0x000001F01E660000-memory.dmp

Download