WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

472KB
MD5

6c603d4c55d755f3d499430a38ba658b
SHA1

35b3ac690ddcc7c9efebe566efd4da349c355157
SHA256

d7dab0f6156c3f1da927202579a675d1671c946e634033ae647f27b09bfcabac
SHA512

691c9fc9fc7b33b9ffd1a5282166f34d081a0df7ecd5cf3b0ecbbbb2e26dc3f14efebf67663522fc4cf5e195bb63bd375950c965f58fea17c79bbcec331a3aae
SSDEEP

12288:wFjRHiTAQ0meqyorrMYA1JMliOevtkc2HywPA:cjRHwAf1JoEvPGiOevtkcyhI

Score

N/A

Malware Config

Signatures

Files

WerFault.exe
.exe windows x86

c4254bb6dcc347d1c7d827f761fb0176

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:52:15:87:da:30:b1:5e:80:55:ed:8e:d5:ed:c5:75:da:ce:c3:f9:26:9a:8f:4e:12:fe:a7:7e:10:79:87:db
Signer

Actual PE Digest

50:52:15:87:da:30:b1:5e:80:55:ed:8e:d5:ed:c5:75:da:ce:c3:f9:26:9a:8f:4e:12:fe:a7:7e:10:79:87:db

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

realloc
wcsncpy_s
wcscat_s
memcmp
_CxxThrowException
swprintf_s
memset
_callnewh
wcscpy_s
towlower
isspace
tolower
_wtoi64
wcsstr
wcsncmp
toupper
_wcstoui64
malloc
_purecall
memmove_s
_snwscanf_s
wcsrchr
_wtoi
wcspbrk
memmove
_controlfp
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
wcschr
_cexit
iswspace
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
free
_vsnprintf_s
_wcsicmp
_wcsnicmp
_vscwprintf
memcpy
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
__CxxFrameHandler3

cryptsp

CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
FreeLibrary
LoadStringW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

CreateEventW
AcquireSRWLockShared
CreateMutexW
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockShared
OpenMutexW
ReleaseMutex
AcquireSRWLockExclusive
DeleteCriticalSection
WaitForSingleObjectEx
InitializeSRWLock
WaitForSingleObject
OpenEventW
ResetEvent
ReleaseSRWLockExclusive
ReleaseSemaphore
TryEnterCriticalSection
EnterCriticalSection
CreateSemaphoreExW
SetEvent
InitializeCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

GetThreadId
OpenProcessToken
GetProcessTimes
GetPriorityClass
GetProcessId
SetThreadPriority
GetCurrentThreadId
GetThreadPriority
SetPriorityClass
CreateThread
GetExitCodeThread
CreateProcessW
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
OpenThread
TerminateProcess

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetSystemDefaultLangID
LCMapStringW
GetThreadUILanguage
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemDirectoryW
GetTickCount64
GetSystemInfo
GetTickCount
GetVersionExW

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeExW
MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-wow64-l1-1-1

IsWow64Process2
GetSystemWow64DirectoryW

api-ms-win-core-com-l1-1-0

CoUnmarshalInterface
CoTaskMemFree
CoGetMalloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitializeEx
ProgIDFromCLSID
CLSIDFromString
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocStringLen

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
SetKernelObjectSecurity
SetSecurityDescriptorDacl
EqualSid
GetKernelObjectSecurity
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
GetLengthSid
CopySid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CreateWellKnownSid
InitializeSecurityDescriptor

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-file-l1-1-0

GetDriveTypeW
FileTimeToLocalFileTime
DeleteFileW
WriteFile
CreateFileW
GetFileAttributesExW
GetFileAttributesW
GetLogicalDriveStringsW
ReadFile
CompareFileTime
QueryDosDeviceW
GetFileSize
GetFinalPathNameByHandleW
GetDiskFreeSpaceExW
GetLongPathNameW
GetTempFileNameW
SetFileInformationByHandle
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualQuery
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
VirtualQueryEx
VirtualFree
ReadProcessMemory
VirtualAlloc

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegEnumKeyExW
RegSetKeySecurity
RegDeleteTreeW
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueW
RegGetKeySecurity
RegEnumValueW

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32GetModuleFileNameExW
QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadContext
GetThreadTimes

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
SetThreadpoolTimer

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
RegisterEventSourceW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlSecondsSince1970ToTime
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtQueryInformationToken
NtQueryInformationThread
NtQueryInformationProcess
RtlInitUnicodeString
RtlNtStatusToDosError
RtlImageNtHeaderEx
RtlGetVersion
NtOpenEvent
NtQueryEvent
NtQueryLicenseValue
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetSystemInformation
RtlAdjustPrivilege
RtlGetUnloadEventTraceEx
RtlSetThreadErrorMode
PssNtCaptureSnapshot
DbgPrint
ZwQueryInformationThread
NtQueryObject
RtlAllocateHeap
DbgPrintEx
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtWaitForSingleObject
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
NtCreateFile
NtQuerySystemInformation
NtClose
NtSuspendProcess
NtResumeProcess
RtlCreateProcessReflection
NtSystemDebugControl
NtPowerInformation
RtlFreeSid
RtlFreeHeap

wer

WerpSetExitListeners
WerpCreateMachineStore
WerpAddTerminationReason
WerpValidateReportKey
WerpGetStorePath
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
WerpAuxmdFree
WerpFreeUnmappedVaRanges
WerpFlushImageCache
WerpForceDeferredCollection
WerpTraceSnapshotStatistics
WerpTraceAuxMemDumpStatistics
WerpTraceUnmappedVaRangesStatistics
WerpTraceImageCacheStatistics
WerpResetTransientImageCacheStatistics
WerpStitchedMinidumpVmQueryCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmPostReadCallback
WerpGetReportFlags
WerpSetReportFlags
WerReportSetUIOption
WerpIsTransportAvailable
WerpRestartApplication
WerpAuxmdInitialize
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdMapFile
WerpInitializeImageCache
WerpUnmapProcessViews
WerpAddFile
WerpSetReportNamespaceParameter
WerpReportCancel
WerpCreateIntegratorReportId
WerpSetIntegratorReportId
WerpFreeString
WerpSetTelemetryAppParams
WerReportCreate
WerpGetReportId
WerpReportSprintfParameter
WerpSetTelemetryKernelParams
WerpSetIptEnabled
WerpPromptUser
WerpSetTtdStatus
WerReportAddFile
WerpReserveMachineQueueReportDir
WerpSetCallBack
WerpSetReportIsFatal
WerReportSubmit
WerpGetNumFiles
WerpGetFileByIndex
WerpAddAppCompatData
WerReportAddDump
WerpAddRegisteredDataToReport
WerpGetExtendedDiagData
WerpAddMemoryBlock
WerReportCloseHandle
WerpSetDynamicParameter
WerReportSetParameter
WerpSetEventName
WerpHashApplicationParameters
WerpSetReportApplicationIdentity
WerpSetProcessTimelines

api-ms-win-downlevel-shlwapi-l2-1-0

IsOS

dbghelp

SymInitialize
MiniDumpWriteDump
SymCleanup
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymGetModuleInfoW64

api-ms-win-core-com-private-l1-1-0

CoGetActivationState
CoGetCallState

api-ms-win-core-windowserrorreporting-l1-1-0

WerGetFlags
GetApplicationRestartSettings

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-processsnapshot-l1-1-0

PssDuplicateSnapshot
PssWalkMarkerFree
PssWalkMarkerCreate
PssQuerySnapshot

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW

bcrypt

BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace
QueryTraceW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegDeleteKeyA
RegDeleteKeyW

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
Module32FirstW
Module32NextW
Thread32First
Process32FirstW
CreateToolhelp32Snapshot
Thread32Next

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessIoCounters

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-security-trustee-l1-1-0

BuildSecurityDescriptorW

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4254bb6dcc347d1c7d827f761fb0176

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8bCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

50:52:15:87:da:30:b1:5e:80:55:ed:8e:d5:ed:c5:75:da:ce:c3:f9:26:9a:8f:4e:12:fe:a7:7e:10:79:87:dbSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

cryptsp

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

wer

api-ms-win-downlevel-shlwapi-l2-1-0

dbghelp

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-controller-l1-1-0

bcrypt

rpcrt4

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-eventing-legacy-l1-1-0

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

50:52:15:87:da:30:b1:5e:80:55:ed:8e:d5:ed:c5:75:da:ce:c3:f9:26:9a:8f:4e:12:fe:a7:7e:10:79:87:db
Signer

15/12/2022, 13:55
Valid: false

.text
Size: 330KB - Virtual size: 330KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 16KB - Virtual size: 16KB

.didat
Size: 512B - Virtual size: 268B

.rsrc
Size: 90KB - Virtual size: 90KB

.reloc
Size: 21KB - Virtual size: 20KB