Windows Process Injection Wermgr Child Process

The analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.