WerFault.exe

Windows ProcessMicrosoft Corporation

Also called werfault, windows error reporting, fault handler

WindowsSystem Component

Windows Error Reporting fault handler. It starts when an app crashes so Windows can collect a report. It is not the app that crashed.

What you need to know

This is the crash reporter. Find the process that died. Do not delete WerFault.

WerFault.exe is Windows Error Reporting. A crash starts it. High CPU here is usually the report hang, not a miner named Error.

Safe?: Yes, after a crash
Why is it here?: Another process just failed
Should I end it?: The report dialog closes

Feex says

If WerFault is on top, I look at the name in the dialog. That crashed app is the story. Ending WerFault only closes the reporter.

What is WerFault.exe?

WerFault.exe is the per-fault Windows Error Reporting host. Windows starts a copy for a crashing process.

What does it do?

It can show "has stopped working," collect a dump, and hand off to wermgr.exe. It is not Reliability Monitor itself.

Why is it running?

An app or a system component just faulted. A WerFault that stays for hours on the same PID is a stuck reporter.

Is it safe?

Usually safe

System32 WerFault is WER. A WerFault.exe next to a game crack is not Microsoft reporting.

A legitimate copy normally runs from:

C:\Windows\System32\WerFault.exe

Starts after a crash
Sibling: wermgr.exe
The crashed app is a different image

Can I end it?

Closes the report UI

Ending WerFault.exe dismisses the crash dialog. The original app is already dead or restarting.

Can I remove it?

Do not delete WerFault.exe. You can turn off sending reports in Settings > Privacy > Diagnostics. That is not the same as deleting the handler.

Should it start with Windows?

Crashes start it. It should not be a Startup Apps entry.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Can rise while writing a dump
Disk: Dump files under ProgramData\Microsoft\Windows\WER
Network: If you send reports
Memory: Follows dump size

File information

WerFault.exe file information
Executable name	WerFault.exe
Common legitimate path	C:\Windows\System32\WerFault.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

WerFault on a loop

The app is crashing in a restart loop. Repair that app. Killing WerFault only hides the toast.

Confused with the crashed game

The game image is still the faulting module. WerFault is the reporter.

Troubleshooting

Diagnose before you change anything destructive.

Reliability Monitor or Event Viewer

See the faulting application name. That is the fix target.

Do not disable WER as a first step

You lose crash history you will want later.

Technical details

WerFault.exe technical details
Image name	WerFault.exe
Role	WER fault host

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Windows Error Reporting · WerFault handler
Microsoft Support: Windows · Public support naming
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.