WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

515KB
MD5

55223db91b1c6d993ce9c73529c9d0c3
SHA1

7c7d6bb9f33eed5b0d3d146058d2ab06e35273af
SHA256

4ac8723bfdf117b49c6a25dfe1573429611a92fb2a074c79a83b6cc48bd6a634
SHA512

343686bc2280b209d37278ac9d8b393bba40569bf0db4d903cc64c823701261d0e83410e5ed53d530aeb402c75a650cd89d43771746c6725bde2ba245e58c2ab
SSDEEP

12288:vTtpuh0OXUaVt9Kt9rsJ+mI5PU4eh41DGJWczvcqWCEBFbc2HywOdDI:vBUhNEut9Kt9rmyzEsIWCEBFbcyhR

Score

1^/10

Malware Config

Signatures

Files

WerFault.exe
.exe windows:10 windows x86 arch:x86

a868900838651362fd9810bcbad2a19a

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:83:2b:f8:0f:a6:9b:97:9a:03:39:e0:d6:e5:4b:43:3f:99:88:ab:72:ec:c6:b9:67:e3:71:78:52:5d:4e:1c
Signer

Actual PE Digest

a5:83:2b:f8:0f:a6:9b:97:9a:03:39:e0:d6:e5:4b:43:3f:99:88:ab:72:ec:c6:b9:67:e3:71:78:52:5d:4e:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsnicmp
_o__wcstoui64
memmove
_o__wtoi
_o__wtoi64
_o_exit
_o_free
_o_isspace
_o_malloc
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_except_handler4_common
__current_exception
__current_exception_context
_CxxThrowException
_o__get_initial_wide_environment
_o__exit
_o__errno
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
wcsrchr
wcsstr
wcschr
__std_terminate
__CxxFrameHandler3
_o__wcsicmp
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp
memset
wcsnlen

cryptsp

CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameA

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetKeySecurity
RegDeleteTreeW
RegGetKeySecurity
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegCloseKey
RegDeleteValueW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ResetEvent
InitializeCriticalSectionEx
OpenEventW
OpenMutexW
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateSemaphoreExW
CreateMutexW
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
TryEnterCriticalSection
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
SearchPathW
GetCommandLineW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
OpenThread
GetPriorityClass
SetThreadPriority
GetCurrentThreadId
GetThreadId
GetProcessId
GetThreadPriority
SetPriorityClass
TerminateProcess
CreateThread
GetExitCodeProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetCurrentThread
GetProcessTimes

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
WaitOnAddress
WakeByAddressSingle

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID
FormatMessageW
GetThreadUILanguage
GetUserGeoID
LCMapStringW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadContext
IsProcessorFeaturePresent
GetThreadTimes
SetProcessMitigationPolicy

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetSystemDirectoryW
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-security-base-l1-1-0

EqualSid
AllocateAndInitializeSid
GetSidSubAuthorityCount
GetTokenInformation
CheckTokenMembership
GetSidSubAuthority
CopySid
CreateWellKnownSid
GetLengthSid
IsValidSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
SetKernelObjectSecurity

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
GetLogicalDriveStringsW
QueryDosDeviceW
GetDriveTypeW
CreateDirectoryW
FindClose
SetFileAttributesW
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetFileSizeEx
GetFileAttributesW
CreateFileW
GetFinalPathNameByHandleW
GetLongPathNameW
FindFirstFileW
FindNextFileW
WriteFile
CompareFileTime
ReadFile
DeleteFileW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW
IsWow64Process2

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32GetModuleFileNameExW
QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
GetStringTypeExW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoSetProxyBlanket
CoUnmarshalInterface
CLSIDFromString
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
ProgIDFromCLSID

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualQuery
OpenFileMappingW
VirtualFree
VirtualAlloc
ReadProcessMemory
VirtualQueryEx

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-path-l1-1-0

PathCchStripToRoot

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation

api-ms-win-core-file-l1-2-4

GetTempPath2W

rpcrt4

UuidCreate

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtClose
NtQueryEvent
NtOpenEvent
RtlGetVersion
RtlImageNtHeaderEx
NtQueryInformationProcess
NtFreeVirtualMemory
NtSetSystemInformation
RtlAdjustPrivilege
RtlGetUnloadEventTraceEx
NtQueryInformationThread
RtlNtStatusToDosError
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
RtlSetThreadErrorMode
EtwRegisterTraceGuidsW
NtSetInformationFile
NtQuerySystemInformation
DbgPrint
ZwQueryInformationThread
RtlInitUnicodeString
RtlSecondsSince1970ToTime
NtQueryInformationToken
NtQueryObject
NtCreateFile
DbgPrintEx
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtWaitForSingleObject
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
EtwGetTraceEnableLevel
RtlFreeSid
NtSystemDebugControl
NtPowerInformation
RtlFreeHeap
RtlCreateProcessReflection
NtResumeProcess
NtSuspendProcess
PssNtCaptureSnapshot

wer

WerpHashApplicationParameters
WerpSetEventName
WerReportSetParameter
WerpSetDynamicParameter
WerpSetReportNamespaceParameter
WerpInitializeImageCache
WerpAuxmdMapFile
WerpAuxmdHashVaRanges
WerpAuxmdFreeCopyBuffer
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdDumpProcessImages
WerpAuxmdInitialize
WerpRestartApplication
WerpIsTransportAvailable
WerReportSetUIOption
WerpSetReportFlags
WerpGetReportFlags
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpResetTransientImageCacheStatistics
WerpTraceImageCacheStatistics
WerpTraceUnmappedVaRangesStatistics
WerpTraceAuxMemDumpStatistics
WerpTraceSnapshotStatistics
WerpForceDeferredCollection
WerpFlushImageCache
WerpFreeUnmappedVaRanges
WerpAuxmdFree
WerReportCloseHandle
WerpFreeString
WerpAddMemoryBlock
WerpGetExtendedDiagData
WerpAddRegisteredDataToReport
WerReportAddDump
WerpAddAppCompatData
WerpGetFileByIndex
WerpGetNumFiles
WerReportSubmit
WerpSetReportIsFatal
WerpSetCallBack
WerpGetReportId
WerReportCreate
WerpSetProcessTimelines
WerpSetTelemetryAppParams
WerpSetIntegratorReportId
WerpCreateIntegratorReportId
WerpAddFile
WerpSetReportApplicationIdentity
WerpCreateMachineStore
WerpSetExitListeners
WerpReportSprintfParameter
WerpSetTelemetryKernelParams
WerpSetIptEnabled
WerpPromptUser
WerpSetTtdStatus
WerReportAddFile
WerpReserveMachineQueueReportDir
WerpAddTerminationReason
WerpValidateReportKey
WerpGetStorePath
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
WerpReportCancel
GetThreadWaitChain
WerpUnmapProcessViews
CloseThreadWaitChainSession

dbghelp

SymInitialize
MiniDumpWriteDump
StackWalk64
SymFunctionTableAccess64
SymSetExtendedOption
SymGetModuleInfoW64
SymCleanup
SymGetModuleBase64

diagnosticdatasettings

TelGetWerTelemetryMode

api-ms-win-core-com-private-l1-1-0

CoGetActivationState
CoGetCallState

api-ms-win-core-windowserrorreporting-l1-1-0

GetApplicationRestartSettings
WerGetFlags

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-processsnapshot-l1-1-0

PssQuerySnapshot
PssWalkMarkerFree
PssDuplicateSnapshot
PssWalkMarkerCreate

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_DevNode_PropertyW
CM_Get_Device_ID_ListW
CM_MapCrToWin32Err
CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace
QueryTraceW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegOpenKeyW
RegDeleteKeyA

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-toolhelp-l1-1-0

Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
Process32NextW
Thread32First
Thread32Next
Module32NextW

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessIoCounters

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-security-trustee-l1-1-0

BuildSecurityDescriptorW

faultrep

WerpInitiateCrashReporting

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a868900838651362fd9810bcbad2a19a

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a5:83:2b:f8:0f:a6:9b:97:9a:03:39:e0:d6:e5:4b:43:3f:99:88:ab:72:ec:c6:b9:67:e3:71:78:52:5d:4e:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

cryptsp

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-file-l1-2-4

rpcrt4

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

wer

dbghelp

diagnosticdatasettings

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-controller-l1-1-0

bcrypt

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-eventing-legacy-l1-1-0

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a5:83:2b:f8:0f:a6:9b:97:9a:03:39:e0:d6:e5:4b:43:3f:99:88:ab:72:ec:c6:b9:67:e3:71:78:52:5d:4e:1c
Signer

.text
Size: 370KB - Virtual size: 370KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 17KB - Virtual size: 17KB

.didat
Size: 512B - Virtual size: 264B

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 22KB - Virtual size: 21KB