DFIRHub

Windows event log ยท Application1001 Application Crash

I've personally seen malicious executables being recorded in these events given that malware is inherently unstable and meant to cause destruction on the host system.

  • Application
  • 1 field
  • Application.evtx
  • Windows Error Reporting

Notes

  • I've personally seen malicious executables being recorded in these events given that malware is inherently unstable and meant to cause destruction on the host system.
  • Please add any other file extensions as you see fit.
  • As always, check the Payload column for all info recorded for this event.

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • ExecutableInfo%ExecutableInfo%
    • %ExecutableInfo% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Windows Error Reporting"/>
    <EventID Qualifiers="0">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-11-26 18:16:01.6874915"/>
    <EventRecordID>12240</EventRecordID>
    <Correlation/>
    <Execution ProcessID="0" ThreadID="0"/>
    <Channel>Application</Channel>
    <Computer>HOSTNAME</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>2197605730095248713, 1, APPCRASH, Not available, 0, Battle.net.exe, 1.29.0.12511, 5fb30cf2, battle.net.dll, 1.29.0.12511, 5fb30cd7, c0000006, 01034c81,
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6AD.tmp.WERInternalMetadata.xml, \\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Battle.net.exe_07df855d37a14863a6117edd6f7142347b0a57d_11b545ed_04b66fa9-9d42-4380-a370-51bdd98f4e80, 0, f380f3b9-326d-4192-bd08-453b67cf1de0, 268435456, a5a0ff54bdfc3e434e7f76c4a2b0b549, 0</Data>
    <Binary></Binary>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Application_Windows-Error-Reporting_1001.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)