CmdID

CmdID / Files

wermgr.exe

Windows Problem Reporting file version info

Program on Windows 24 known copies with hashes 12 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wermgr.exe?

file version info and known copies
Original nameWerMgr in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Problem Reporting

24 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wermgr.exe · signed by Microsoft Windows

10ccd06b4405d2c18880ef8aed9d6f023f2d49f49f1603cb476238b2f2fa8381

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wermgr.exe · signed by Microsoft Windows

47dcc9fa193d17fec71ef1314134489a925b3782be0dea5786cd7a72715e238d

10.0.19041.685 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

d5b2188f3bb067df02fbc194af4e34e538f15bd1f9af739b260fa0e59e6a9bdc

10.0.19041.685 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

edce588f879e657b24037dd0ae3233c97ce9b0e4a115c62bbf00c983ef288a85

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

163b8e6177378572cc370bd71f79400e5a94d39994f624b88930a8192ea000e3

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

23de870a5147f2e3e9aca874530394ef1d6f5e68a469a242a8eb1d1669fdfa01

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

9edb0c76df62b6e24a39a4c48e50b3366537ecf95eeb918b906db107969c1b11

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

f7340a244c4b736d91abfb09b524077ae9924b9bca85c290682a8a42730cd93c

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

12c55e6c072775a148f04b9d2972c4e49bdb517c78d88bb09bd04540a0b4f889

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

62a913977b0c17269b19a60727e24b4cfd10cc5c482e41ee9784ad16515ffe38

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

1c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

2e3a50377a292687519bb004d77d1a289646b59d21dd6147347d2816ac679e9e

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\wermgr.exe · signed by Microsoft Windows

c5ec3fca29d708229326cd91cdcf2f7ff82f8bfb23ea686d81abbb28f54c887d

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wermgr.exe · signed by Microsoft Windows

e66f5bd21473b17267fc1558c0bc91277acb5a00235df8f6c6de9eb5325e2861

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

54d4f163ba41963a1e1be46e14882bbbe98a45f635b098326d8e7da2f2f77320

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

acba1fa5f47d1777984df28f0c30f70a2df45eeab0afda76ae09eafcd3533281

10.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

61a84b2d8ca05c11e79db8e18feb0fe4be1b8d555d0be2651516b144800153ab

10.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

eb41af0d81823c5cf55ef807036eda73a85abcfdc544c8bf13b360834ae28d76

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\system32\wermgr.exe · signed by Microsoft Windows

171fec664bf454217f5e5d23b782ecaa7a07f3989703b4d6bf2c213721b0395a

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

e009858f54086cdec86d5c1c55e6d3dc7a678d158d863f74be1944f3fd1bbb16

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\wermgr.exe · signed by Microsoft Windows

2973e50e212efbc6623b0f69fe2e6a7cf4b5aa5a2e5a4a7895671f369ab04190

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

eb391b2bb8949242b9ec4a6210f3d877c7cc6f9ce8872940d0e67fa7c12a9860

6.3.9600.19649 (winblue_ltsb.200208-0600) · C:\windows\SysWOW64\wermgr.exe · signed by Microsoft Windows

d7d7587c90eb23e3cc178e326a5eab66f2528ff114bcbf92b499dd5f3924672c

6.3.9600.19649 (winblue_ltsb.200208-0600) · C:\windows\system32\wermgr.exe · signed by Microsoft Windows

f489aae1f59e19d15f44775d77a64686503aebe11aec6167167088ea03b545d5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wermgr.exe
highPotential CVE-2021-26857 Exploitation AttemptBhabesh Raj
highPotential CVE-2023-36874 Exploitation - Fake Wermgr ExecutionNasreddine Bencherchali (Nextron Systems)
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
highPotential Pikabot Hollowing ActivityAndreas Braathen (mnemonic.io)
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Execution Location Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highTrickbot Malware ActivityFlorian Roth (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names wermgr.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.