WerFault.exe

  • File Path: C:\WINDOWS\SysWOW64\WerFault.exe
  • Description: Windows Problem Reporting

Hashes

Type Hash
MD5 ED9AABD0A7F0A73DB7B45FABBE3489CE
SHA1 5AC4D5A7410EE5B449B0A84CF85C4358C9BC60EC
SHA256 61993174B365A724B1381D5EBC87E76A2C40A5889DF7F1A83F3DCE7CCD64A98B
SHA384 F30CFE7EB882A362D266FED4717081988AEEA71462AA6A2386E9D65D54BC3F952AF3428226A8ED23256A64C6C82317A0
SHA512 D8840BE48EF82CE4F10B5E9F2B12728678DC97AEFE6DDBAE60B9073C5E94E15604AB6447F05BF722B164A519DDE2987761AE6FB102D56DFA913C80CAD598CFDA
SSDEEP 12288:Ckr/VXnt5NxZll0APF8qgLf6tm9sFvIc2Hywv:Xr/VXnt5NxZlb6r9sFvIcyhv

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: WerFault.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.836 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.836
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of WerFault.exe being misused. While WerFault.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_exploit_cve_2020_1350.yml - '\System32\werfault.exe' DRL 1.0
sigma win_lsass_dump.yml Image\|endswith: '\werfault.exe' DRL 1.0
sigma win_wmiprvse_spawning_process.yml - '\WerFault.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.