detection.wiki
Blog

Windows Error Reporting

1 events across 1 channel

Event IDTitleChannel
1001Fault bucket , type 0 Event Name: crashpad_log Response: Not available Cab Id: 0 …Application

Event ID 1001 — Fault bucket , type 0 Event Name: crashpad_log Response: Not available Cab Id: 0 Problem signature: P1: MicrosoftEdgeUpdate.

Provider
Windows Error Reporting
Channel
Application
Level
4
Samples
1

Message

Fault bucket %1, type %2
Event Name: %3
Response: %4
Cab Id: %5

Problem signature:
P1: %6
P2: %7
P3: %8
P4: %9
P5: %10
P6: %11
P7: %12
P8: %13
P9: %14
P10: %15

Attached files:%16

These files may be available here:
%17

Analysis symbol: %18
Rechecking for solution: %19
Report Id: %20
Report Status: %21
Hashed bucket: %22
Cab Guid: %23

Fields

NameDescription
Data—

Example Event

system:
  provider: Windows Error Reporting
  guid: ''
  event_source_name: ''
  event_id: 1001
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T16:57:43.146445+00:00'
  event_record_id: 40
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: ''
event_data:
  Data:
  - ''
  - '0'
  - crashpad_log
  - Not available
  - '0'
  - MicrosoftEdgeUpdate.exe
  - 1.3.135.41
  - InstallError
  - '0x80040801'
  - ''
  - ''
  - ''
  - ''
  - ''
  - ''
  - ''
  - \\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_MicrosoftEdgeUpd_cdca63462e6d61d11e7ef74fbb3859979d55_00000000_b116c47d-48e9-4cf6-a84b-ec895efdf585
  - ''
  - '0'
  - b116c47d-48e9-4cf6-a84b-ec895efdf585
  - '6'
  - ''
  - '0'
message: "Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: Not available\nCab
  Id: 0\n\nProblem signature:\nP1: MicrosoftEdgeUpdate.exe\nP2: 1.3.135.41\nP3: InstallError\nP4:
  0x80040801\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\nThese files
  may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_MicrosoftEdgeUpd_cdca63462e6d61d11e7ef74fbb3859979d55_00000000_b116c47d-48e9-4cf6-a84b-ec895efdf585\n\nAnalysis
  symbol: \nRechecking for solution: 0\nReport Id: b116c47d-48e9-4cf6-a84b-ec895efdf585\nReport
  Status: 6\nHashed bucket: \nCab Guid: 0"

Sigma Rules

References