fdi.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 21, 2021, 6:58 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 30867456 registers.r15: 1998659424 registers.rcx: 0 registers.rsi: 0 registers.r10: 31060528 registers.rbx: 1 registers.rsp: 1960648 registers.r11: 2164392969 registers.r8: 0 registers.r9: 23 registers.rdx: 1960688 registers.r12: 30867456 registers.rbp: 1960720 registers.rdi: 1 registers.rax: 2532016 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 21, 2021, 6:58 p.m.	process_identifier: 4244 region_size: 217088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d70000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0002d200', u'virtual_address': u'0x000ba000', u'entropy': 6.880606331466274, u'name': u'.rdata', u'virtual_size': u'0x0002d132'}

entropy

6.88060633147

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14