91bb36fb598b49b08ed115dda2cf311acad808e25c8aa1feb9642e2f2420e565

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 04:34

Target
LuminAutoTweaker.exe
Size 200.9MB
Sample260530-e7bltsfz7q
SHA256 91bb36fb598b49b08ed115dda2cf311acad808e25c8aa1feb9642e2f2420e565
MD5 542d144d4c8df706551911eecc055f35
SHA1 8a6fea37be12b910d3a4cd03376eaafe2d933bf1
SHA512 6904f583b6dac2e89f353c93080db6ec94d385b4ccfa91d7eb03565e9d3767c27f65d8aa13f3457111002fed9792ecb3ab3438364cec10eb7d0038d00da829e6
SSDEEP 786432:l4b3mYETdcak6pobIV5OtsFTbSssc7JCZjHGeAZT2ud/nF9PQG1BLgFBPtmnXYcB:o2YSdGmoUxSssKQmdauBYG7gFBMIoPx3
TLSH
T183A88D15A3D85629D17BC234C7728662D6F0BC629324C2CF1095FA193E73BC16A36B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Loads dropped DLL 3 IoCs

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	LuminAutoTweaker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1076	3652	LuminAutoTweaker.exe	80
PID 1076 wrote to memory of 3960	1076	Bridge.exe	81
PID 3652 wrote to memory of 3996	3652	LuminAutoTweaker.exe	82
PID 3996 wrote to memory of 3804	3996	Bridge.exe	83

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 75fc0d383ea009ea9453a4589fa8d88d149abcac371bb5eb983d6ece8f1243eb
MD5 a5e9f16c6a381a2241bef8eed1c20309
SHA1 574d1412c55cb2321d2d6545cbb439368623e2a5
SHA512 d9509720807f9298caa1af3abbb098348726700815559febd3417d929e57c7839f498391e92e2a02d8c984db9bf786d25170471fea71bc64c9329b29242244e7
SSDEEP 24576:Tl8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9k:TH6emPXrYCqX4T3Q1Niqzc74xb4izMp7
TLSH
T118453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 1ccb4943ef0d472d70e1cb4738f89fb457010e12fa82379daf2dc64cf59d6e9b
MD5 62585acd299185da1f109f935b4320ed
SHA1 6f51669ac4581d6f6e58b99f4a2f6d5ee9e55b6c
SHA512 cf7aee56e1443292b8f71c050a78849f663e8d0be492678f7ea74d5b1f62f12782044bf9ea8469434b15360c8e7eba670bf5a78af7c14b718ad5cb641aade38c
SSDEEP 24576:fp3YLMLrT18UP2HTePBDpuZiV1/QcqylsQdS/etT4ZdSAcMGuOk8SlXlTm:am3iUP2HKBDpuSUypM2tWdSAc5uOq5s
TLSH
T1B8953A46B6EC40EAD47AE23CD9D7461BF27278142761A7CF23A0479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download