maui | c482d2d04f8f62a2151a859fffa41c24af65a397f6fad5203914954465f635b3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 00:42

Target
2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe
Size 763KB
Sample240615-a2t4rsshja
SHA256 c482d2d04f8f62a2151a859fffa41c24af65a397f6fad5203914954465f635b3
MD5 967201031711e5d7d77cc1d04c23cf4b
SHA1 409fe9bd5e0850164786d76887e442a732c7b0e5
SHA512 475e67f31d2390d5534a9ec0d0503379d1c134ed9178ccba4536fd0fc6248d39275514b79ec6b7b0b83cae494299fdebd3c5ddba27904604e80d9608a905042b
SSDEEP 12288:p+2NRE6xDWPOO3Kt7RJatTrAtfpYqCX9b:phRxWPOO3Kt7FfpYhXx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maui ransomware

Detect Maui ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1476-0-0x0000000000290000-0x0000000000356000-memory.dmp	family_maui

Maui Ransomware
Ransomware-as-a-Service which first appeared in 2022.
ransomware maui

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	1476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1564	1476	2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe	29
PID 1476 wrote to memory of 1564	1476	2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe	29
PID 1476 wrote to memory of 1564	1476	2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe	29
PID 1476 wrote to memory of 1564	1476	2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 96
  2⤵
  - Program crash
  PID:1564

memory/1476-0-0x0000000000290000-0x0000000000356000-memory.dmp

Download