# WerFault.exe

Windows Process: Microsoft Corporation

Also called werfault, windows error reporting, fault handler

Windows, System Component

Windows Error Reporting fault handler. It starts when an app crashes so Windows can collect a report. It is not the app that crashed.

## What you need to know

This is the crash reporter. Find the process that died. Do not delete WerFault.

WerFault.exe is Windows Error Reporting. A crash starts it. High CPU here is usually the report hang, not a miner named Error.

- **Safe?**: Yes, after a crash

  **Why is it here?**: Another process just failed

  **Should I end it?**: The report dialog closes

Feex says

If WerFault is on top, I look at the name in the dialog. That crashed app is the story. Ending WerFault only closes the reporter.

## What is WerFault.exe?

WerFault.exe is the per-fault Windows Error Reporting host. Windows starts a copy for a crashing process.

## What does it do?

It can show "has stopped working," collect a dump, and hand off to wermgr.exe. It is not Reliability Monitor itself.

## Why is it running?

An app or a system component just faulted. A WerFault that stays for hours on the same PID is a stuck reporter.

## Is it safe?

Usually safe

System32 WerFault is WER. A WerFault.exe next to a game crack is not Microsoft reporting.

A legitimate copy normally runs from:

`C:\Windows\System32\WerFault.exe`

- Starts after a crash
- Sibling: wermgr.exe
- The crashed app is a different image

## Can I end it?

Closes the report UI

Ending WerFault.exe dismisses the crash dialog. The original app is already dead or restarting.

## Can I remove it?

No

Do not delete WerFault.exe. You can turn off sending reports in Settings > Privacy > Diagnostics. That is not the same as deleting the handler.

## Should it start with Windows?

Crashes start it. It should not be a Startup Apps entry.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise while writing a dump

  **Disk**: Dump files under ProgramData\Microsoft\Windows\WER

  **Network**: If you send reports

  **Memory**: Follows dump size

## File information

| Executable name        | WerFault.exe                     |
| ---------------------- | -------------------------------- |
| Common legitimate path | C:\Windows\System32\WerFault.exe |
| Publisher              | Microsoft Corporation            |
| Signature expectation  | Signed by Microsoft Windows      |

## Common problems

### WerFault on a loop

The app is crashing in a restart loop. Repair that app. Killing WerFault only hides the toast.

### Confused with the crashed game

The game image is still the faulting module. WerFault is the reporter.

## Troubleshooting

Diagnose before you change anything destructive.

### Reliability Monitor or Event Viewer

See the faulting application name. That is the fix target.

### Do not disable WER as a first step

You lose crash history you will want later.

## Technical details

Technical details

| Image name | WerFault.exe   |
| ---------- | -------------- |
| Role       | WER fault host |

## Related

These entities connect to this article. Type is shown on every link.

[wermgr.exe: Windows Process](https://feex.it/wiki/process/wermgr.exe)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Windows Error Reporting ](https://learn.microsoft.com/windows/win32/wer/windows-error-reporting)· WerFault handler
- [Microsoft Support: Windows ](https://support.microsoft.com/windows)· Public support naming
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: WerFault.exe

  **Typical path**: C:\Windows\System32\WerFault.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/werfault.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)