werfault.exe
Windows Problem Reporting by Microsoft Corporation (Signed)
This is a Windows system installed file with Windows File Protection (WFP) enabled.
Overview
There are 7 versions of werfault.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). werfault.exe is run as a standard windows process with the logged in user's account privileges. The average file size is about 371.4 KB. The file is a digitally signed and issued to Microsoft Corporation by Microsoft Corporation. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 4.86 MB with the maximum memory reaching around 15.9 MB. Addionally, typically read and write I/O disk operations is about 276 Bytes per minute for reads and 2 Bytes per minute for writes.
 Details
|
| File name: | werfault.exe |
| Publisher: | Microsoft Corporation |
| Product name: | Windows Problem Reporting |
| Description: | Microsoft® Windows® Operating System |
| Typical file path: | C:\Windows\System32\werfault.exe |
| Original name: | WerFault.exe.mui |
| Certificate |
| Issued to: | Microsoft Corporation |
| Authority (CA): | Microsoft Corporation |
| Effective date: | Tuesday, April 10, 2012 |
| Expiration date: | Wednesday, July 10, 2013 |
Behaviors
(Note, the behaviors below are for all versions of werfault.exe, select a unique version for details.)
Startup files (all users) run once
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
- '*WerKernelReporting' → C:\Windows\SYSTEM32\WerFault.exe -k -rq
All file variations of werfault.exe
