DFIRHub

Windows event log · Microsoft-Windows-WER-Diag/Operational4 Application Crash on Launch

I've personally seen malicious executables being recorded in these events given that malware is inherently unstable and meant to cause destruction on the host system.

  • Windows operational
  • 4 fields
  • Microsoft-Windows-WER-Diag%4Operational.evtx
  • Microsoft-Windows-WER-Diag

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • ExecutableInfo%ModuleName%
    • %ModuleName% = /Event/EventData/Data[2]
  • PayloadData1ProcessId: %ProcessId%
    • %ProcessId% = /Event/EventData/Data[@Name="ProcessId"]
  • PayloadData2StartTime: %StartTime%
    • %StartTime% = /Event/EventData/Data[@Name="StartTime"]
  • PayloadData3CrashTimeFromStart: %CrashTimeFromStart%
    • %CrashTimeFromStart% = /Event/EventData/Data[@Name="CrashTimeFromStart"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-WER-Diag" Guid="aabc069-a01b-40a0-ba40-9484258dedc5"/>
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8004000000000000</Keywords>
    <TimeCreated SystemTime="2021-02-13 13:23:54.41235647"/>
    <EventRecordID>341</EventRecordID>
    <Correlation/>
    <Execution ProcessID="9160" ThreadID="9140"/>
    <Channel>Microsoft-Windows-WER-Diag/Operational</Channel>
    <Computer>HOSTNAME.domain</Computer>
    <Security UserID="S-1-5-21-3700416482-41278834-2147634035-1001"/>
  </System>
  <EventData Name="CRASH_ON_LAUNCH">
    <Data Name="ProcessId">12345</Data>
    <Data Name="ModuleName">C:\Users\user\AppData\Roaming\abcd\evil.dll</Data>
    <Data Name="StartTime">1325767912328572620</Data>
    <Data Name="CrashTimeFromStart">154679327</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-WER-Diag-Operational_Microsoft-Windows-WER-Diag_4.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)