CmdID

CmdID / Files

WerFault.exe

Windows Problem Reporting file version info

Program on Windows 24 known copies with hashes 27 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WerFault.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Problem Reporting

24 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WerFault.exe · signed by Microsoft Windows

256d9c8f4c86723bab2c1afb29dcc6aff5cd302894e7b207f9c869dee08f0268

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WerFault.exe · signed by Microsoft Windows

6bc28220fdd5b33a92c3ac2d60b298f3f4bf6bbcff11827254eb51cd813e1c6a

10.0.19041.630 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

83a761b12295b06047be6ca13a142e2b944f7394d6baec64956612dc1ce64461

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

49fc3b1febd3f56466d930e35b1cb5be76113cfee92d721923ec2c8034c8dcf0

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

f79420be1161a86fc1caa09d062c5c835929913b48f10eeccc8179dea9a318dc

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

23e2b8dc4b1327ed034ffcf7b04c6f52558271339a52b46d9968d7950dadc160

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

4906290168dad75af6513d93b80ce09692d5285ccda384e55085d9b5fb46fcf8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

05ee1a3ce81c001f5b175b60c35d6a91ee8766db9a18bcefa8ce9b4b160182db

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

26f9d0295b00ae31c5fb42f727e394d6377bc433118d8e405d932b4c51476abf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

5e6540869a48565787573f9e6ed168d3074ada48ed1b732c1615c980af711f34

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

df42a4557521bacae0d4982ed804762a2815dc157723725a19304632d9b49204

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

f69ff67fd26f7659d6d92c1a6d060d9bc6915e4fe048671c46bb42e57cc64518

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WerFault.exe · signed by Microsoft Windows

61993174b365a724b1381d5ebc87e76a2c40a5889df7f1a83f3dce7ccd64a98b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WerFault.exe · signed by Microsoft Windows

59771b825b108e13ce89fb07570c9ac0ccff0926ab6b7cb579a9a264d5fe9056

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

4e87e4c2c71b519b402e1d6fbd818ab2eaab712bfdc61ac741ea9ed8850e7c27

10.0.17763.1339 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

0eefe1dde46d019b6be035fed5ecc867c9965cb13362f940dad5e0f02dafb4e3

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

bc3a271deb217692a1c628d9f987361dd020c91bfd0d1af509fb124ef4127ce7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

3b4cefd893a605d8cc768a09ab0f34bbb02d21495eb088f582095d985944f247

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

dc9adb75c9e3cb860619cd3c76544fde47f3839de775d9a9ed410f1e0d6e765a

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\WerFault.exe · signed by Microsoft Windows

fe943a3ad65d3db0af499d5367989a0148b981bfd9b80149d8a7b65d692039b8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WerFault.exe · signed by Microsoft Windows

46cabae805b8c9e95255814366f0e5517e30ab7e7414e4f288d6ac5072d6d140

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

4bc022bb58b3af9f724410e32b56bc61479226a1d0df1065eec6fa4909c33f4f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\WerFault.exe · signed by Microsoft Windows

5c7f45a1a9609496f669a821c0fe52260d2530342820b618eec8b75a5acd5ebc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\WerFault.exe · signed by Microsoft Windows

b9c76ec4bf6d6fe3f6f65e8f8fd0d344d3da310f903141ed24533aa36710e84b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WerFault.exe
criticalDNS RCE CVE-2020-1350Florian Roth (Nextron Systems)
highBad Opsec Defaults Sacrificial Processes With Improper ArgumentsOleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
highPotential CVE-2021-26857 Exploitation AttemptBhabesh Raj
highPotential Credential Dumping Via WER@pbssubhash , Nasreddine Bencherchali
highPotential SNAKE Malware Persistence Service ExecutionNasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Event Viewer Child ProcessFlorian Roth (Nextron Systems)
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highSuspicious Sysmon as Execution ParentFlorian Roth (Nextron Systems), Tim Shelton (fp werfault)
highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highUAC Bypass Using Consent and Comctl32 - ProcessChristian Burkard (Nextron Systems)
highUAC Bypass via ICMLuaUtilFlorian Roth (Nextron Systems), Elastic (idea)
mediumDiskshadow Child Process SpawnedHarjot Singh @cyb3rjy0t
mediumPotential ReflectDebugger Content Execution Via WerFault.EXEX__Junior (Nextron Systems)
mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)
mediumUAC Bypass via Windows Firewall Snap-In HijackTim Rauch, Elastic (idea)
mediumUncommon Child Process Of AddinUtil.EXEMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
mediumUncommon Sigverif.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)
mediumWmiPrvSE Spawned A ProcessRoberto Rodriguez @Cyb3rWard0g

Sigma names WerFault.exe in 27 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.