dl2.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 21, 2021, 6:52 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 4259840 registers.r15: 1998659424 registers.rcx: 0 registers.rsi: 0 registers.r10: 4452912 registers.rbx: 1 registers.rsp: 1829704 registers.r11: 2164392969 registers.r8: 0 registers.r9: 23 registers.rdx: 1829744 registers.r12: 4259840 registers.rbp: 1829776 registers.rdi: 1 registers.rax: 2663088 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 21, 2021, 6:52 p.m.	process_identifier: 5628 region_size: 217088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000410000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0002ca00', u'virtual_address': u'0x000b8000', u'entropy': 6.889219049699664, u'name': u'.rdata', u'virtual_size': u'0x0002c90c'}

entropy

6.8892190497

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

FireEye	Generic.mg.900bcb73268ea52c
McAfee	Artemis!900BCB73268E
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Generik.FIIMZXO
TrendMicro-HouseCall	Trojan.Win64.BAZARLOADER.FAIR
Avast	Win64:CrypterX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
AegisLab	Trojan.Win32.Generic.4!c
APEX	Malicious
TrendMicro	Trojan.Win64.BAZARLOADER.FAIR
McAfee-GW-Edition	BehavesLike.Win64.Generic.dh
Sophos	Mal/Generic-S
Ikarus	Trojan.SuspectCRC
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Rising	Malware.Undefined!8.C (CLOUD)
Fortinet	W32/Generik.FIIMZXO!tr
AVG	Win64:CrypterX-gen [Trj]
Qihoo-360	Win64/Trojan.Generic.HgEASRIA