DFIRHub

Windows event log ยท Application1000 Application Error

I've personally seen malicious executables being recorded in these events given that malware is inherently unstable and meant to cause destruction on the host system.

  • Application
  • 1 field
  • Application.evtx
  • Application Error

Notes

  • I've personally seen malicious executables being recorded in these events given that malware is inherently unstable and meant to cause destruction on the host system.
  • Please add any other file extensions as you see fit.
  • As always, check the Payload column for all info recorded for this event.

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • ExecutableInfo%ExecutableInfo%
    • %ExecutableInfo% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Application Error"/>
    <EventID Qualifiers="0">1000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>100</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-11-26 18:15:52.2640182"/>
    <EventRecordID>12237</EventRecordID>
    <Correlation/>
    <Execution ProcessID="0" ThreadID="0"/>
    <Channel>Application</Channel>
    <Computer>HOSTNAME</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Battle.net.exe, 1.29.0.12511, 5fb30cf2, battle.net.dll, 1.29.0.12511, 5fb30cd7, c0000006, 01034c81, 6c3c, 01d6c40460409565, E:\Battle.net\Battle.net.exe, E:\Battle.net\Battle.net.12511\battle.net.dll, f380f3b9-326d-4192-bd08-453b67cf1de0</Data>
    <Binary></Binary>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Application_Application-Error_1000.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)