Memory Protection Violation for WerFault.exe
Summary: Memory Protection Violation for WerFault.exe
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Note:
- As of May 2022, Dell Endpoint Security Suite Enterprise has reached End of Maintenance. This article is no longer updated by Dell. For more information, reference the Product Life Cycle (End of Support / End of Life) Policy for Dell Data Security. If you have any questions on alternative articles, either reach out to your sales team or contact endpointsecurity@dell.com.
- Reference Endpoint Security for additional information about current products.
Affected Products:
- Dell Endpoint Security Suite Enterprise
- WerFault.exe is a part of the Windows Error Reporting System.
- It appears as a notification when a corruption or malfunction occurs with an application.
- This notification can appear at any time within the Windows environment and Memory Protection monitors it.
Cause
Not Applicable
Resolution
WerFault.exe may present a Remote Unmap of Memory violation.
Note: Remote Unmap of Memory is defined as a process has removed a Windows executable from the memory of another process, which is central to the functionality that the Windows Error Reporting System provides.
Figure 1: (English Only) Advanced Threats
For more information about Memory Protection category definitions, reference Memory Protection category definitions.
The exclusion path for Memory Protection is as follows:
\Windows\system32\WerFault.exe
You may also see an exploit at this location:
\Windows\SysWOW64\WerFault.exe
Apply either exclusion as necessary. For more information about how to add Memory Protection exclusions, reference How to Add Exclusions to Dell Endpoint Security Suite Enterprise.
Warning: Any Memory Protection violations for WerFault.exe that are not Remote Unmap of Memory should be investigated on a case-by-case basis.
To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.
Affected Products
Dell Endpoint Security Suite EnterpriseArticle Properties
Article Number: 000123257
Article Type: Solution
Last Modified: 08 Sep 2023
Version: 8
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.