c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695

Analysis

user interaction
yes
max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:15

Target
Optical Flares v1.3.8 (170).exe
Size 39.4MB
Sample260804-16b2vsyzhy
SHA256 c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695
MD5 aefa0c287108abcfe07033604b9278d6
SHA1 dc25bce783f6f163ee7c48c1fe89ed901b9fe89b
SHA512 75f0b49831f921ac824783830e3b4d0a6d809074249fc420aad60865d9bdd21890727825b3f518ce0f66443ea0df015fd0931a362640da636be50ee167f50ab1
SSDEEP 786432:kQ6n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QxS6:kQE8tmSBZiiXM97lfcbi51SoS6
TLSH
T1AD97234BB29900EAC87AC03C8596954BF2723851037497EB37ED965A6F37BF11A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5264	Optical Flares v1.3.8 (170).exe
5264	Optical Flares v1.3.8 (170).exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 5264	5228	Optical Flares v1.3.8 (170).exe	89

C:\Users\Admin\AppData\Local\Temp\Optical Flares v1.3.8 (170).exe
"C:\Users\Admin\AppData\Local\Temp\Optical Flares v1.3.8 (170).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Users\Admin\AppData\Local\Temp\Optical Flares v1.3.8 (170).exe
  "C:\Users\Admin\AppData\Local\Temp\Optical Flares v1.3.8 (170).exe" /UAC
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5264

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact