werfault.exe

WerFault.exe runs Windows Error Reporting (WER). When a process faults, Windows launches WerFault.exe to gather a crash report, which can include a memory dump of the faulting process, and to surface the error to the user. Its parent is usually the WER service inside svchost.exe or the faulting application, and it runs from C:\Windows\System32\WerFault.exe (a hardened variant, WerFaultSecure.exe, exists for protected processes).

Legitimately, WerFault appears whenever something crashes or hangs, so short-lived instances are routine and not a concern on their own. A WerFault that lingers, spawns other programs, or reaches the network is out of character.

WerFault.exe is attractive to attackers because it is signed, expected, and easy to overlook. It is a common injection target (T1055): code placed inside a WerFault process inherits a trusted identity and blends into the normal churn of crash handling, so unusual loaded modules or network activity from WerFault is worth examining.

The same crash-dump machinery is also a credential-access route (T1003.001). Techniques that force or hijack WER, for example the "silent process exit" mechanism, can make the system produce a full memory dump of lsass.exe through WerFault, handing over credentials without a recognizable dumping tool. A WerFault tied to an lsass dump file, or one that spawns a process, is the case to run down.

Its trusted name also makes it an impersonation target (T1036.005), so a WerFault.exe outside System32 is suspect on its face.