WerFault.exe

by Microsoft

Operating System

Sources: 300M+ executions observed in the wild.

Summary

Windows Error Reporting (WerFault.exe) handles application crash reporting and diagnostics. When an application crashes, Windows launches WerFault.exe to collect crash information, generate dump files, and optionally send crash reports to Microsoft.

WerFault.exe is the 25th most commonly executed Windows program in EchoTrail's dataset, observed 2,268,217 times across enterprise environments. It typically runs from C:\Windows\SysWOW64 and it is most often launched by svchost.exe.

Get this in your tools

The same record for werfault.exe, by REST or as an MCP tool. Free key, no card.

Get a free key

curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/werfault.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

25th

most commonly executed Windows program

2,268,217

observed endpoint executions

Behavior

Top Paths

C:\Windows\SysWOW6493.62%
C:\Windows\System326.38%

Top Hashes (SHA256)

4f750e87daacd7fb78f038643054fbe2dc3b4f3e7ecebea57fb6690a56b06c4523.46%
85f6c2c06213b05b649f98dda99be8ecccf6dbbb6a849cd8c125ccfe9d887ce712.04%
dfa55ed025227b20b113969ec06f68c41b1d5e49b00784fd34e491f3875cd1e011.38%
5c7f45a1a9609496f669a821c0fe52260d2530342820b618eec8b75a5acd5ebc7.64%
e66d50f0a3aab23f48f1e213d8eb0e674438bda3ce7bcd5ec91a577128ef016d7.5%
a8fbad7b5a4c081ca3a84a0f0e1f61793dc32a1d98cceb2dabbd887b3c6248f96.96%
37c5a318e82106262b1798e14f961689d86c976cf18396feb7d0976057ddc3df5.85%
f068679d3874bd1619020da64325ffd284a553d401313b29d37823cb29dfa6f35.67%
11549ca1b8f26f1c934caa19ebe80cfca6eaa3ddca37e9e5d01c9d541e8448924.95%
61993174b365a724b1381d5ebc87e76a2c40a5889df7f1a83f3dce7ccd64a98b3.68%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Security Analysis

What does WerFault.exe normally do?

Located in C:\Windows\System32 (64-bit) or C:\Windows\SysWOW64 (32-bit). Launched by svchost.exe (WER service), by the crashing process itself, or by management/monitoring tools. The SysWOW64 path is more common (as seen in the data) because 32-bit application crashes are handled by the SysWOW64 version.

When is WerFault.exe suspicious?

Running from a non-standard path. Spawning child processes (WerFault is an endpoint in the process chain, not a launching point). Making outbound network connections to non-Microsoft destinations. Persistent execution (WerFault should be transient — it runs, collects data, and exits).

How do attackers abuse WerFault.exe?

Name masquerading: malware may use the werfault.exe name to avoid suspicion since it is a common, expected process. LSASS dump via WerFault: the Windows Error Reporting mechanism can be abused to create memory dumps of processes (including LSASS) through silent process exit or WER API calls, which is a known credential access technique.

Detection guidance

Medium-confidence: werfault.exe running from a non-standard path. WerFault creating dump files of sensitive processes (lsass.exe). WerFault persisting or running for extended periods. Monitor for Sysmon Event ID 11 (FileCreate) with WerFault as the source creating .dmp files in unexpected locations.

False positive notes

Common in environments with unstable applications. Management tools (SolarWinds, ZENworks) may trigger WerFault when their components crash. High WerFault volume usually indicates application stability issues rather than attacks.

MITRE ATT&CK techniques

T1036.005

Related Processes

svchost.exe wermgr.exe

Ask Rocky about WerFault.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for WerFault.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.