WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

564KB
MD5

26c84a467b489a0e60f3720ae5b064dc
SHA1

74a37701f7d4c9d899a857546c3410d650a72eb3
SHA256

9a0064029ce405645241c3eaba297f6c8a554e2e899ee7e3ddfa5341b5768475
SHA512

1a9e7ff6409ccec733fa80dbd7250b4fd5687517b7652150fa85e383e503c7f5d1bf5d4bb0216247e86525fa546502cd340a4f51eaaf93e5775ec209e1c81a17
SSDEEP

12288:Oc8m9ougNRVwwIBYwKNkYEAmVHQOivk4Ec2Hywb:HuvfkVOOivk4Ecyhb

Score

1^/10

Malware Config

Signatures

Files

WerFault.exe
.exe windows:10 windows x64 arch:x64

35f27a7eb4cce7d6739c09071336b429

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:68:9f:0f:e6:75:d9:b1:69:a0:5c:65:d8:e8:e9:d0:ed:9d:a8:4d:b0:8c:aa:ef:a9:7b:70:42:e2:19:1c:ae
Signer

Actual PE Digest

10:68:9f:0f:e6:75:d9:b1:69:a0:5c:65:d8:e8:e9:d0:ed:9d:a8:4d:b0:8c:aa:ef:a9:7b:70:42:e2:19:1c:ae

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WerFault.pdb

Imports

msvcrt

memcpy
memmove
realloc
__setusermatherr
wcsncpy_s
_CxxThrowException
swprintf_s
_initterm
_fmode
memcmp
wcscat_s
_commode
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
memset
wcscmp
_callnewh
wcscpy_s
towlower
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
isspace
tolower
_purecall
_wtoi64
wcsstr
wcsncmp
memmove_s
__C_specific_handler
toupper
_wcstoui64
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
_snwscanf_s
wcsrchr
_wtoi
wcspbrk
wcschr
iswspace
_wcsicmp
_wcsnicmp
_vscwprintf
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_cexit
_vsnwprintf
_exit
__CxxFrameHandler3

cryptsp

CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
LoadStringW
GetProcAddress
FreeLibraryAndExitThread
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
AcquireSRWLockExclusive
CreateSemaphoreExW
InitializeSRWLock
InitializeCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
OpenEventW
WaitForSingleObjectEx
EnterCriticalSection
ResetEvent
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateMutexW
SetEvent
AcquireSRWLockShared
CreateEventW
WaitForSingleObject
OpenMutexW
OpenSemaphoreW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetThreadId
OpenProcessToken
GetProcessTimes
CreateProcessW
GetCurrentThreadId
TerminateProcess
GetCurrentThread
GetCurrentProcessId
OpenThread
GetThreadPriority
GetCurrentProcess
GetProcessId
SetThreadPriority
GetExitCodeThread
GetPriorityClass
SetPriorityClass

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetSystemDefaultLangID
GetUserGeoID
GetThreadUILanguage
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventProviderEnabled
EventWriteTransfer
EventWrite
EventRegister

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetTickCount64
GetSystemInfo
GetVersionExW
GlobalMemoryStatusEx
GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
GetStringTypeExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-wow64-l1-1-1

IsWow64Process2
GetSystemWow64DirectoryW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CoUnmarshalInterface
CoUninitialize
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocStringLen

api-ms-win-security-base-l1-1-0

GetSidSubAuthority
EqualSid
GetSidSubAuthorityCount
GetTokenInformation
CreateWellKnownSid
IsValidSid
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CopySid
GetLengthSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetLogicalDriveStringsW
GetFileAttributesW
QueryDosDeviceW
GetDriveTypeW
SetFileAttributesW
GetDiskFreeSpaceExW
GetFinalPathNameByHandleW
GetTempFileNameW
GetFileSize
DeleteFileW
FindFirstFileW
WriteFile
ReadFile
FindClose
GetLongPathNameW
FindNextFileW
CompareFileTime
FileTimeToLocalFileTime
GetFileAttributesExW
SetFileInformationByHandle
CreateFileW

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
VirtualQuery
ReadProcessMemory
VirtualQueryEx
VirtualAlloc
VirtualFree

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegSetKeySecurity
RegCloseKey
RegGetKeySecurity
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteTreeW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW
K32EnumProcessModules
QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy
GetThreadContext
OpenProcess
GetThreadTimes

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW
SearchPathW
GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW
DeregisterEventSource
RegisterEventSourceW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
RtlSecondsSince1970ToTime
EtwUnregisterTraceGuids
NtQueryInformationToken
NtQueryInformationThread
NtQueryInformationProcess
RtlInitUnicodeString
RtlNtStatusToDosError
RtlImageNtHeaderEx
RtlGetVersion
NtOpenEvent
NtQueryEvent
NtClose
NtQuerySystemInformation
NtQueryLicenseValue
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtDeviceIoControlFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetSystemInformation
RtlAdjustPrivilege
RtlGetUnloadEventTraceEx
RtlSetThreadErrorMode
PssNtCaptureSnapshot
DbgPrint
ZwQueryInformationThread
NtQueryObject
RtlAllocateHeap
DbgPrintEx
ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtCreateFile
NtSuspendProcess
NtResumeProcess
RtlCreateProcessReflection
NtSystemDebugControl
NtPowerInformation
RtlFreeHeap
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtWaitForSingleObject
RtlAllocateAndInitializeSid

wer

WerpSetExitListeners
WerpCreateMachineStore
WerpAddTerminationReason
WerpValidateReportKey
WerpGetStorePath
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
WerpAuxmdFree
WerpFreeUnmappedVaRanges
WerpFlushImageCache
WerpForceDeferredCollection
WerpTraceSnapshotStatistics
WerpTraceAuxMemDumpStatistics
WerpTraceUnmappedVaRangesStatistics
WerpTraceImageCacheStatistics
WerpResetTransientImageCacheStatistics
WerpStitchedMinidumpVmQueryCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmPostReadCallback
WerpGetReportFlags
WerpSetReportFlags
WerReportSetUIOption
WerpIsTransportAvailable
WerpRestartApplication
WerpAuxmdInitialize
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdMapFile
WerpInitializeImageCache
WerpUnmapProcessViews
WerpAddFile
WerpSetReportNamespaceParameter
WerpReportCancel
WerpCreateIntegratorReportId
WerpFreeString
WerpSetTelemetryAppParams
WerpSetProcessTimelines
WerReportCreate
WerpReportSprintfParameter
WerpSetTelemetryKernelParams
WerpSetIptEnabled
WerpPromptUser
WerpSetTtdStatus
WerReportAddFile
WerpReserveMachineQueueReportDir
WerpGetReportId
WerpSetCallBack
WerpSetReportIsFatal
WerReportSubmit
WerpGetNumFiles
WerpGetFileByIndex
WerpAddAppCompatData
WerReportAddDump
WerpAddRegisteredDataToReport
WerpGetExtendedDiagData
WerpAddMemoryBlock
WerReportCloseHandle
WerpSetDynamicParameter
WerReportSetParameter
WerpSetEventName
WerpHashApplicationParameters
WerpSetReportApplicationIdentity
WerpSetIntegratorReportId

api-ms-win-downlevel-shlwapi-l2-1-0

IsOS

dbghelp

SymInitialize
StackWalk64
SymGetModuleInfoW64
SymGetModuleBase64
SymCleanup
SymFunctionTableAccess64
MiniDumpWriteDump

api-ms-win-core-com-private-l1-1-0

CoGetCallState
CoGetActivationState

api-ms-win-core-windowserrorreporting-l1-1-0

WerGetFlags
GetApplicationRestartSettings

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-processsnapshot-l1-1-0

PssQuerySnapshot
PssDuplicateSnapshot
PssWalkMarkerCreate
PssWalkMarkerFree

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW

bcrypt

BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptCreateHash

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW
EnableTrace

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegOpenKeyW
RegDeleteKeyW

api-ms-win-core-toolhelp-l1-1-0

Thread32Next
Thread32First
Process32FirstW
Module32NextW
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessIoCounters

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-security-trustee-l1-1-0

BuildSecurityDescriptorW

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35f27a7eb4cce7d6739c09071336b429

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

10:68:9f:0f:e6:75:d9:b1:69:a0:5c:65:d8:e8:e9:d0:ed:9d:a8:4d:b0:8c:aa:ef:a9:7b:70:42:e2:19:1c:aeSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

cryptsp

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

wer

api-ms-win-downlevel-shlwapi-l2-1-0

dbghelp

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-controller-l1-1-0

bcrypt

rpcrt4

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-toolhelp-l1-1-0

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

10:68:9f:0f:e6:75:d9:b1:69:a0:5c:65:d8:e8:e9:d0:ed:9d:a8:4d:b0:8c:aa:ef:a9:7b:70:42:e2:19:1c:ae
Signer

.text
Size: 340KB - Virtual size: 340KB

.imrsiv
Size: - Virtual size: 4B

.rdata
Size: 105KB - Virtual size: 105KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 536B

.rsrc
Size: 90KB - Virtual size: 90KB

.reloc
Size: 1KB - Virtual size: 1KB