WerFault.exe
Summary
Windows Error Reporting (WerFault.exe) handles application crash reporting and diagnostics. When an application crashes, Windows launches WerFault.exe to collect crash information, generate dump files, and optionally send crash reports to Microsoft.
WerFault.exe is the 25th most commonly executed Windows program in EchoTrail's dataset, observed 2,268,217 times across enterprise environments. It typically runs from C:\Windows\SysWOW64 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\SysWOW6493.62%
- C:\Windows\System326.38%
Top Hashes (SHA256)
- 4f750e87daacd7fb78f038643054fbe2dc3b4f3e7ecebea57fb6690a56b06c4523.46%
- 85f6c2c06213b05b649f98dda99be8ecccf6dbbb6a849cd8c125ccfe9d887ce712.04%
- dfa55ed025227b20b113969ec06f68c41b1d5e49b00784fd34e491f3875cd1e011.38%
- 5c7f45a1a9609496f669a821c0fe52260d2530342820b618eec8b75a5acd5ebc7.64%
- e66d50f0a3aab23f48f1e213d8eb0e674438bda3ce7bcd5ec91a577128ef016d7.5%
- a8fbad7b5a4c081ca3a84a0f0e1f61793dc32a1d98cceb2dabbd887b3c6248f96.96%
- 37c5a318e82106262b1798e14f961689d86c976cf18396feb7d0976057ddc3df5.85%
- f068679d3874bd1619020da64325ffd284a553d401313b29d37823cb29dfa6f35.67%
- 11549ca1b8f26f1c934caa19ebe80cfca6eaa3ddca37e9e5d01c9d541e8448924.95%
- 61993174b365a724b1381d5ebc87e76a2c40a5889df7f1a83f3dce7ccd64a98b3.68%
Process Ancestry
Top Grandparents
- services.exe83.72%
- SearchIndexer.exe9.91%
- svchost.exe2.69%
- QBW32.EXE1.22%
- cmd.exe0.42%
- AsusTPLoader.exe0.21%
- explorer.exe0.2%
- RdrCEF.exe0.19%
- iexplore.exe0.18%
- slack.exe0.17%
Top Parents
- svchost.exe35.19%
- SWJobEngineSvc2.exe33.08%
- zDPrf.exe28.17%
- SearchFilterHost.exe1.61%
- audiodg.exe0.13%
- WmiPrvSE.exe0.11%
- DropboxCleanup.exe0.07%
- Microsoft.Photos.exe0.07%
Top Children
- WerFault.exe20.28%
- OUTLOOK.EXE19.19%
- explorer.exe17.12%
- wermgr.exe13.74%
- lync.exe4.58%
- EXCEL.EXE4.14%
- rundll32.exe2.73%
- conhost.exe2.18%
- GROOVE.EXE1.53%
- OneDrive.exe1.53%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does WerFault.exe normally do?
Located in C:\Windows\System32 (64-bit) or C:\Windows\SysWOW64 (32-bit). Launched by svchost.exe (WER service), by the crashing process itself, or by management/monitoring tools. The SysWOW64 path is more common (as seen in the data) because 32-bit application crashes are handled by the SysWOW64 version.
When is WerFault.exe suspicious?
Running from a non-standard path. Spawning child processes (WerFault is an endpoint in the process chain, not a launching point). Making outbound network connections to non-Microsoft destinations. Persistent execution (WerFault should be transient — it runs, collects data, and exits).
How do attackers abuse WerFault.exe?
Name masquerading: malware may use the werfault.exe name to avoid suspicion since it is a common, expected process. LSASS dump via WerFault: the Windows Error Reporting mechanism can be abused to create memory dumps of processes (including LSASS) through silent process exit or WER API calls, which is a known credential access technique.
Detection guidance
Medium-confidence: werfault.exe running from a non-standard path. WerFault creating dump files of sensitive processes (lsass.exe). WerFault persisting or running for extended periods. Monitor for Sysmon Event ID 11 (FileCreate) with WerFault as the source creating .dmp files in unexpected locations.
False positive notes
Common in environments with unstable applications. Management tools (SolarWinds, ZENworks) may trigger WerFault when their components crash. High WerFault volume usually indicates application stability issues rather than attacks.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about WerFault.exe
Rocky answers questions about WerFault.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.