WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

613KB
MD5

cf3b31b1d6aeac14a76db152ac4ca0dd
SHA1

5e26911276933e949c3c57034ecc45157baa05c2
SHA256

cc8fe9122a1c78f788752d3d1802fab79ea9953370b551faf3693ffd17878429
SHA512

2faca79653f24c67858283143d19938681d380bc5dd35141dff9a6035d9374e1d757bc49307c749cca60d3c002064525eac6c1d7e0662b6b0876d2a20a989b6c
SSDEEP

12288:Y9cK4DZS2L8xTX2jsPqu9bMHRZJYrJU1CXLhm2BE6Fwc2HywyN:Y94DZ2xYu5/QCXdLBE6FwcyhG

Score

1^/10

Malware Config

Signatures

Files

WerFault.exe
.exe windows:10 windows x64 arch:x64

8818a13c92816cf3d989d01a7b03b804

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:5c:7f:20:cf:c5:01:1a:9a:f7:d6:41:ad:de:54:db:c0:23:68:13:f0:ff:53:37:fd:e9:1b:08:b2:a3:9f:57
Signer

Actual PE Digest

83:5c:7f:20:cf:c5:01:1a:9a:f7:d6:41:ad:de:54:db:c0:23:68:13:f0:ff:53:37:fd:e9:1b:08:b2:a3:9f:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WerFault.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsnicmp
_o___std_exception_copy
_o__wcstoui64
_o__wtoi
_o__wtoi64
memmove
_o_exit
_o_free
_o_isspace
_o_malloc
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___p__commode
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o___p___wargv
_o__get_initial_wide_environment
_o___p___argc
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
wcsrchr
wcsstr
wcschr
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o___std_exception_destroy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp
memset
wcscmp
wcsnlen

cryptsp

CryptReleaseContext
CryptAcquireContextW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
LoadStringW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetKeySecurity
RegDeleteTreeW
RegGetKeySecurity
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegGetValueW
RegEnumValueW
RegDeleteValueW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SearchPathW
GetCommandLineW
ExpandEnvironmentStringsW
SetEnvironmentVariableW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
SetErrorMode
GetLastError

api-ms-win-core-processthreads-l1-1-0

OpenThread
GetCurrentThreadId
GetPriorityClass
SetPriorityClass
SetThreadPriority
CreateThread
GetThreadId
GetThreadPriority
GetCurrentProcess
GetCurrentProcessId
GetProcessId
GetExitCodeProcess
CreateProcessW
OpenProcessToken
TerminateProcess
GetProcessTimes
GetCurrentThread

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
InitOnceComplete
Sleep
InitOnceBeginInitialize
WaitOnAddress

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID
FormatMessageW
GetThreadUILanguage
GetUserGeoID
LCMapStringW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent
SetProcessMitigationPolicy
GetThreadTimes
GetThreadContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemDirectoryW
GetWindowsDirectoryW
GetTickCount
GetVersionExW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
LeaveCriticalSection
CreateEventW
TryEnterCriticalSection
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
ResetEvent
ReleaseSRWLockShared
CreateMutexExW
CreateMutexW
OpenMutexW
OpenEventW
WaitForSingleObject
ReleaseSRWLockExclusive
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
SetEvent

api-ms-win-security-base-l1-1-0

EqualSid
AllocateAndInitializeSid
GetSidSubAuthorityCount
GetTokenInformation
CheckTokenMembership
GetSidSubAuthority
CopySid
CreateWellKnownSid
GetLengthSid
IsValidSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
SetKernelObjectSecurity

api-ms-win-core-file-l1-1-0

QueryDosDeviceW
GetDriveTypeW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetFileSizeEx
SetFileAttributesW
DeleteFileW
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileAttributesW
CreateDirectoryW
CreateFileW
GetFinalPathNameByHandleW
GetLongPathNameW
FindFirstFileW
FindNextFileW
WriteFile
ReadFile
FindClose
CompareFileTime

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW
IsWow64Process2

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
QueryFullProcessImageNameW
K32EnumProcessModules

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
GetStringTypeExW

api-ms-win-core-com-l1-1-0

ProgIDFromCLSID
CoSetProxyBlanket
CLSIDFromString
CoUnmarshalInterface
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualQuery
ReadProcessMemory
OpenFileMappingW
VirtualFree
VirtualAlloc
VirtualQueryEx

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-path-l1-1-0

PathCchStripToRoot

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation

api-ms-win-core-file-l1-2-4

GetTempPath2W

rpcrt4

UuidCreate

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryEvent
NtOpenEvent
RtlGetVersion
RtlImageNtHeaderEx
NtQueryInformationProcess
NtQueryInformationThread
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetSystemInformation
RtlNtStatusToDosError
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
RtlAdjustPrivilege
RtlGetUnloadEventTraceEx
NtSetInformationFile
PssNtCaptureSnapshot
DbgPrint
ZwQueryInformationThread
NtQuerySystemInformation
RtlSecondsSince1970ToTime
NtQueryInformationToken
NtQueryObject
RtlInitUnicodeString
DbgPrintEx
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtWaitForSingleObject
RtlAllocateAndInitializeSid
NtAlpcConnectPort
EtwRegisterTraceGuidsW
NtAlpcSendWaitReceivePort
RtlFreeSid
NtCreateFile
NtSystemDebugControl
NtPowerInformation
RtlCreateProcessReflection
NtResumeProcess
NtClose
RtlSetThreadErrorMode
NtSuspendProcess

wer

WerpHashApplicationParameters
WerpSetEventName
WerReportSetParameter
WerpSetDynamicParameter
WerpSetReportNamespaceParameter
WerpInitializeImageCache
WerpAuxmdMapFile
WerpAuxmdHashVaRanges
WerpAuxmdFreeCopyBuffer
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdDumpProcessImages
WerpAuxmdInitialize
WerpRestartApplication
WerpIsTransportAvailable
WerReportSetUIOption
WerpSetReportFlags
WerpGetReportFlags
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpResetTransientImageCacheStatistics
WerpTraceImageCacheStatistics
WerpTraceUnmappedVaRangesStatistics
WerpTraceAuxMemDumpStatistics
WerpTraceSnapshotStatistics
WerpForceDeferredCollection
WerpFlushImageCache
WerpFreeUnmappedVaRanges
WerpAuxmdFree
WerReportCloseHandle
WerpFreeString
WerpAddMemoryBlock
WerpGetExtendedDiagData
WerpAddRegisteredDataToReport
WerReportAddDump
WerpAddAppCompatData
WerpGetFileByIndex
WerpGetNumFiles
WerReportSubmit
WerpSetReportIsFatal
WerpSetCallBack
WerpGetReportId
WerReportCreate
WerpSetProcessTimelines
WerpSetTelemetryAppParams
WerpSetIntegratorReportId
WerpCreateIntegratorReportId
WerpAddFile
WerpReportCancel
WerpSetReportApplicationIdentity
WerpReportSprintfParameter
WerpSetTelemetryKernelParams
WerpSetIptEnabled
WerpPromptUser
WerpSetTtdStatus
WerReportAddFile
WerpReserveMachineQueueReportDir
WerpCreateMachineStore
WerpSetExitListeners
WerpAddTerminationReason
WerpValidateReportKey
WerpGetStorePath
RegisterWaitChainCOMCallback
CloseThreadWaitChainSession
OpenThreadWaitChainSession
WerpUnmapProcessViews
GetThreadWaitChain

dbghelp

SymInitialize
SymGetModuleBase64
StackWalk64
SymFunctionTableAccess64
SymSetExtendedOption
SymGetModuleInfoW64
SymCleanup
MiniDumpWriteDump

diagnosticdatasettings

TelGetWerTelemetryMode

api-ms-win-core-com-private-l1-1-0

CoGetCallState
CoGetActivationState

api-ms-win-core-windowserrorreporting-l1-1-0

WerGetFlags
GetApplicationRestartSettings

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-processsnapshot-l1-1-0

PssWalkMarkerCreate
PssQuerySnapshot
PssDuplicateSnapshot
PssWalkMarkerFree

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_DevNode_PropertyW
CM_Get_Device_ID_ListW
CM_MapCrToWin32Err
CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-legacy-l1-1-0

EnableTrace
QueryTraceW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegDeleteKeyW
RegOpenKeyW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW
Thread32First
Module32FirstW
Module32NextW
Thread32Next
CreateToolhelp32Snapshot
Process32NextW

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessIoCounters

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-security-trustee-l1-1-0

BuildSecurityDescriptorW

faultrep

WerpInitiateCrashReporting

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8818a13c92816cf3d989d01a7b03b804

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

83:5c:7f:20:cf:c5:01:1a:9a:f7:d6:41:ad:de:54:db:c0:23:68:13:f0:ff:53:37:fd:e9:1b:08:b2:a3:9f:57Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

cryptsp

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-file-l1-2-4

rpcrt4

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

wer

dbghelp

diagnosticdatasettings

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-controller-l1-1-0

bcrypt

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

83:5c:7f:20:cf:c5:01:1a:9a:f7:d6:41:ad:de:54:db:c0:23:68:13:f0:ff:53:37:fd:e9:1b:08:b2:a3:9f:57
Signer

.text
Size: 376KB - Virtual size: 375KB

.imrsiv
Size: - Virtual size: 4B

.rdata
Size: 108KB - Virtual size: 104KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 12KB - Virtual size: 11KB

.didat
Size: 4KB - Virtual size: 528B

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 4KB - Virtual size: 1KB