CmdID

CmdID / Files

WerFaultSecure.exe

Windows Fault Reporting file version info

Program on Windows 22 known copies with hashes 6 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WerFaultSecure.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Fault Reporting

22 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

1fe10f0d94e4b3eae3ed7c86a691866530149e13ea66dc3170e889d0f98f4089

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WerFaultSecure.exe · signed by Microsoft Windows

1c3eea1093a1d691e30003b6373c7bfacdd90eba181c387bd2b7efeeee252b64

10.0.19041.867 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

9ca0fe016d2e7280b1e4d92662bce6b5042c753bcbd86ad24756c3f843a7f06f

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

fef2781843b51e8cb25c9f3757e0312652a205447297f9808b31196f84a9e70e

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

bda1dd2a01667e29770c9ef5b89c92407134607f6b54ea820969f8f2002df798

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

db51c3b291b6711417c91fe7802028b8d8ec2e737b90bab9b4cf4710bc2859d0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

08c6a48e2c35fb92ce7e8749c0c6fb9b2f94a1441214a2925bd13dc41819251f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

1c35464f9a39da371549d8b44ef7838f6b8e17ac1d0aafd8a5593eb7ca960cbb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

3fc0b98b0eacd38246ebefa714939e422b48eba1809d829e9fa8f924ff766cdd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

b3003748290692e15b176bf54ded2220017e412624d3184cfcbb61216534595e

10.0.18362.657 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

a6f7d7374398c69a57dae1baa6d51c80940d6b29eb4d9cdfbfd9a3cb81fd6706

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WerFaultSecure.exe · signed by Microsoft Windows

0b589413ed104a02b369c8b09ece7eba5a94369782dfeb4cd80d877610ce41a8

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

d84f0a050159d0097c1abef7e815f1a2be8c5365745daabc6973b208e73a2ad1

10.0.17763.1339 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

6fe88147901f25f29e4668d1abf4688d0c9229dc27295012ae0f4e5264186591

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

f8df06866a96d5b4f605a52810351762d8baf26d123faeab617bbf34274b5c2d

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

33aed665e00fc25534fb06c19b92b65e8137551aee03f1d6406f0abd82815d63

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

3e23c3ec14af20def1ea552d0f3de4718b25133f2756926b61f55fea663a22f5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

6bd285a4ffc2c5ceabff9a4b510ffb709557b21a8eaee0c542906c185a71909a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows

d06daf85878cc104344116933cfafa63be791e05ea1db4fb61ca180855f4c741

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WerFaultSecure.exe · signed by Microsoft Windows

f9e8a7c43e6e5cd57ef8142e3bfd562761eec0a191e562e45367ddadbb369dcf

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\WerFaultSecure.exe · signed by Microsoft Windows Publisher

bec3c286cf9921843b6fc1f37230f453f1b9ea78b966aea0f615c04c7440b57b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\WerFaultSecure.exe · signed by Microsoft Windows Publisher

f9a61524348b8f482177f8c41a69a92ad6ace26d3f53d1bdf116465dd18632ee

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WerFaultSecure.exe
highPPL Tampering Via WerFaultSecureJason (https://github.com/0xbcf)
highSuspicious Sysmon as Execution ParentFlorian Roth (Nextron Systems), Tim Shelton (fp werfault)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names WerFaultSecure.exe in 6 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.