WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

557KB
MD5

edfdff7bacbd99ab0e81f41e42fe3967
SHA1

82e7a08cbb23bd19396ab231ce045fd969e552bd
SHA256

a538526a8d692aefaff9613d42b709aa7cd6ef475522ced5419d4af616257eda
SHA512

aef45082c98dd2d61c98aa6575226d654616a37159203b64105676065606b5d92a95b942c1aeae43046225fa9194637e85561ec4c8692ed47a2820e68b8c4601
SSDEEP

12288:rD90pef0yfzaBXXiwtiu4u4LOzvRLlzc2Hyw6:rD/CCuSOzvRLlzcyh6

Score

1^/10

Malware Config

Signatures

Files

WerFault.exe
.exe windows x64

d1edc5a53efe89a89018098421f6ee6d

Code Sign

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:4b:06:a9:7a:1d:5e:4e:79:07:28:44:ee:28:8c:d5:d5:b0:2d:db:62:6a:0d:5c:39:ec:60:3c:c1:fa:95:4d
Signer

Actual PE Digest

21:4b:06:a9:7a:1d:5e:4e:79:07:28:44:ee:28:8c:d5:d5:b0:2d:db:62:6a:0d:5c:39:ec:60:3c:c1:fa:95:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_CxxThrowException
realloc
wcsncpy_s
memcpy
swprintf_s
memcmp
wcscat_s
wcscmp
_callnewh
wcscpy_s
towlower
isspace
tolower
_wtoi64
wcsstr
wcsncmp
toupper
_wcstoui64
malloc
_purecall
memmove_s
_snwscanf_s
wcsrchr
_wtoi
wcspbrk
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
wcschr
_fmode
iswspace
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_wcsicmp
_wcsnicmp
_vscwprintf
memmove
free
__C_specific_handler
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
__CxxFrameHandler3

cryptsp

CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
FreeLibraryAndExitThread
GetProcAddress
LoadStringW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockShared
OpenSemaphoreW
CreateSemaphoreExW
OpenMutexW
SetEvent
ResetEvent
ReleaseMutex
CreateEventW
InitializeSRWLock
OpenEventW
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
WaitForSingleObject
CreateMutexW
ReleaseSemaphore
WaitForSingleObjectEx
InitializeCriticalSection
TryEnterCriticalSection
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetErrorMode
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetThreadPriority
GetPriorityClass
GetProcessId
OpenThread
CreateProcessW
GetCurrentThreadId
CreateThread
GetExitCodeThread
SetThreadPriority
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetThreadId
GetProcessTimes
GetCurrentThread
SetPriorityClass

api-ms-win-core-localization-l1-2-0

GetThreadUILanguage
GetSystemDefaultLangID
LCMapStringW
FormatMessageW
GetUserGeoID

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventUnregister
EventRegister
EventWrite
EventWriteTransfer
EventSetInformation

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlCompareMemory
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetTickCount
GetWindowsDirectoryW
GetSystemInfo
GetTickCount64

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeExW
CompareStringW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-wow64-l1-1-1

IsWow64Process2
GetSystemWow64DirectoryW

api-ms-win-core-com-l1-1-0

CoUnmarshalInterface
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx
ProgIDFromCLSID
CLSIDFromString
CoSetProxyBlanket
CoUninitialize

oleaut32

SysFreeString
SysAllocStringLen

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
IsValidSid
GetLengthSid
CopySid
GetKernelObjectSecurity
AllocateAndInitializeSid
CheckTokenMembership
GetSidSubAuthority
FreeSid
CreateWellKnownSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
EqualSid

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFinalPathNameByHandleW
SetFileAttributesW
CreateDirectoryW
GetLongPathNameW
GetTempFileNameW
WriteFile
ReadFile
FindClose
FindNextFileW
FindFirstFileW
SetFileInformationByHandle
CompareFileTime
GetDiskFreeSpaceExW
GetFileAttributesW
CreateFileW
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
GetDriveTypeW
GetFileSize
GetFileAttributesExW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
VirtualAlloc
VirtualQuery
VirtualQueryEx
OpenFileMappingW
MapViewOfFile
VirtualFree
ReadProcessMemory

api-ms-win-core-registry-l1-1-0

RegGetKeySecurity
RegOpenKeyExW
RegSetKeySecurity
RegDeleteValueW
RegGetValueW
RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteTreeW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW
K32EnumProcessModules
K32GetModuleFileNameExW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadContext
GetThreadTimes

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolWait

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SearchPathW
SetEnvironmentVariableW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
RtlSecondsSince1970ToTime
EtwUnregisterTraceGuids
NtQueryInformationToken
NtQueryInformationThread
NtQueryInformationProcess
RtlInitUnicodeString
RtlNtStatusToDosError
RtlImageNtHeaderEx
RtlGetVersion
NtOpenEvent
NtQueryEvent
NtClose
NtQuerySystemInformation
NtQueryLicenseValue
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetSystemInformation
RtlAdjustPrivilege
RtlGetUnloadEventTraceEx
RtlSetThreadErrorMode
PssNtCaptureSnapshot
DbgPrint
ZwQueryInformationThread
NtQueryObject
RtlAllocateHeap
DbgPrintEx
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtCreateFile
NtSuspendProcess
NtResumeProcess
RtlCreateProcessReflection
NtSystemDebugControl
NtPowerInformation
RtlFreeHeap
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtWaitForSingleObject
RtlAllocateAndInitializeSid

wer

WerpSetExitListeners
WerpCreateMachineStore
WerpAddTerminationReason
WerpValidateReportKey
WerpGetStorePath
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
WerpAuxmdFree
WerpFreeUnmappedVaRanges
WerpFlushImageCache
WerpForceDeferredCollection
WerpTraceSnapshotStatistics
WerpTraceAuxMemDumpStatistics
WerpTraceUnmappedVaRangesStatistics
WerpTraceImageCacheStatistics
WerpResetTransientImageCacheStatistics
WerpStitchedMinidumpVmQueryCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmPostReadCallback
WerpGetReportFlags
WerpSetReportFlags
WerReportSetUIOption
WerpIsTransportAvailable
WerpRestartApplication
WerpAuxmdInitialize
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdMapFile
WerpInitializeImageCache
WerpUnmapProcessViews
WerpAddFile
WerpSetReportNamespaceParameter
WerpReportCancel
WerpCreateIntegratorReportId
WerpSetIntegratorReportId
WerpFreeString
WerpSetTelemetryAppParams
WerReportCreate
WerpReportSprintfParameter
WerpSetTelemetryKernelParams
WerpSetIptEnabled
WerpPromptUser
WerpSetTtdStatus
WerReportAddFile
WerpReserveMachineQueueReportDir
WerpGetReportId
WerpSetCallBack
WerpSetReportIsFatal
WerReportSubmit
WerpGetNumFiles
WerpGetFileByIndex
WerpAddAppCompatData
WerReportAddDump
WerpAddRegisteredDataToReport
WerpGetExtendedDiagData
WerpAddMemoryBlock
WerReportCloseHandle
WerpSetDynamicParameter
WerReportSetParameter
WerpSetEventName
WerpHashApplicationParameters
WerpSetReportApplicationIdentity
WerpSetProcessTimelines

api-ms-win-downlevel-shlwapi-l2-1-0

IsOS

dbghelp

SymGetModuleBase64
SymCleanup
MiniDumpWriteDump
StackWalk64
SymInitialize
SymFunctionTableAccess64
SymGetModuleInfoW64

api-ms-win-core-com-private-l1-1-0

CoGetCallState
CoGetActivationState

api-ms-win-core-windowserrorreporting-l1-1-0

WerGetFlags
GetApplicationRestartSettings

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-processsnapshot-l1-1-0

PssWalkMarkerFree
PssQuerySnapshot
PssDuplicateSnapshot
PssWalkMarkerCreate

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW

bcrypt

BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptCreateHash

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace
QueryTraceW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegDeleteKeyA
RegOpenKeyW

api-ms-win-core-toolhelp-l1-1-0

Thread32First
Module32NextW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
Module32FirstW
Thread32Next

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessIoCounters

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-security-trustee-l1-1-0

BuildSecurityDescriptorW

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1edc5a53efe89a89018098421f6ee6d

Code Sign

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

21:4b:06:a9:7a:1d:5e:4e:79:07:28:44:ee:28:8c:d5:d5:b0:2d:db:62:6a:0d:5c:39:ec:60:3c:c1:fa:95:4dSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

cryptsp

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

wer

api-ms-win-downlevel-shlwapi-l2-1-0

dbghelp

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-controller-l1-1-0

bcrypt

rpcrt4

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

21:4b:06:a9:7a:1d:5e:4e:79:07:28:44:ee:28:8c:d5:d5:b0:2d:db:62:6a:0d:5c:39:ec:60:3c:c1:fa:95:4d
Signer

.text
Size: 335KB - Virtual size: 335KB

.imrsiv
Size: - Virtual size: 4B

.rdata
Size: 103KB - Virtual size: 103KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 536B

.rsrc
Size: 90KB - Virtual size: 90KB

.reloc
Size: 1KB - Virtual size: 1KB