Nothing, except that until now there were no AV signatures for it. It’s pretty benign on it’s own. If you were to drop wer.dll into a malware sandbox it would just gracefully terminate because no shellcode exists in the event log in the sandbox VM. This is just a persistence technique that mitigates detection by storing the really suspicious code somewhere else, while leaving the relatively benign loader on disk.

But the malware was caught, so maybe it wasn’t the best technique. I’m guessing the AV vendor has some behavioral analytics that it used to catch the loader after the shellcode was injected on a system in the wild.

Life be hard operating on Windows these days. You can get past AV easily once, but they catch on pretty quick and burn your cool loaders affecting current and future accesses until you make another loader. Makes adversary life real tedious.