EDR-Freeze: Technical Mechanics and Forensic Artifacts Exposed

EDR-Freeze is a proof-of-concept tool that forces endpoint detection and response (EDR) or antivirus processes into a temporary “coma.” It does this not by installing a driver, but by leveraging Windows Error Reporting components, specifically WerFaultSecure.exe and the MiniDumpWriteDump API, to pause security processes from user mode.

By racing threads at the right moment, EDR-Freeze suspends all worker threads in the target and halts telemetry, with the process usually resuming after a configurable delay and often without triggering alerts. The attack begins when EDR-Freeze_1.0.exe launches WerFaultSecure.exe under the cover of Windows Error Reporting, as reported by Researcher, and WerFaultSecure.exe loads dbghelp.dll to invoke MiniDumpWriteDump, which suspends threads during dump creation.

Forensic analysis notes artefacts such as three MsMpEng.exe threads showing suspended timestamps, a temporary t.txt file used to pass encoded dump data, and IAT entries for MiniDumpWriteDump, all of which can help defenders identify the technique during memory forensics and behavioural hunts. according to GBHackers On Security.