Process-Dump

프로세스 덤프 Process Dump는 Windows 역공학 명령줄 도구로, 악성코드 메모리 구성 요소를 디스크로 덤프하여 분석합니다. 악성코드 파일은 종종 AV 스캐너를 피하기 위해 실행 전에 패킹되거나 난독화되지만, 이러한 파일이 실행되면 메모리에서 악성코드 코드의 정상 버전을 언패킹하거나 인젝션하는 경우가 많습니다. 악성코드 연구자가 악성코드를 분석할 때 일반적인 작업 중 하나는 이 언패킹된 코드를 메모리에서 디스크로 덤프하여 AV 제품으로 스캔하거나 IDA와 같은 정적 분석 도구로 분석하는 것입니다. Process...

PPLFaultDumpBOF

Questa è un'opera derivata da https://github.com/gabriellandau/PPLFault. Si prega di consultare quel repository per tutte le ricerche originali e ulteriori informazioni. Questa conversione non modifica intenzionalmente gli IOC della versione originale dello strumento. PPLFaultDumpBOF Prende il...

WSASS

WSASS Questo è uno strumento che utilizza il vecchio programma WerfaultSecure.exe per eseguire il dump della memoria dei processi protetti da PPL Protected Process Light, come LSASS.EXE. L'output è in formato Windows MINIDUMP. Questo strumento sostituisce automaticamente l'intestazione magica"MDM...

Improper Restriction of Communication Channel to Intended Endpoints

Overview Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints in the custom netstack implementation. An attacker can access internal services or execute unauthorized actions by recovering a Wireguard private key from a process dum...

Improper Restriction of Communication Channel to Intended Endpoints

Overview Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints in the custom netstack implementation. An attacker can access internal services or execute unauthorized actions by recovering a Wireguard private key from a process dum...

PPLBlade - Protected Process Dumper Tool

Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...

MemTracer - Memory Scaner

MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework Dynamic-Link...

Information disclosure

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299 Sensitive Data Exposure vulnerability in McAfee True Key Windows Client

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299

CVE-2020-7299 affects the McAfee True Key Windows client. The vulnerability is a cleartext storage of sensitive information in memory, enabling a local administrator to access another user’s passwords on the same machine by triggering a process dump. Affected are True Key versions prior to 6.2.10...

Process Heap Analysis Framework: Python Haystack

Process Heap Analysis Framework python-haystack is an heap analysis framework, focused on searching and reversing of C structure in allocated memory. The first function/API is the SEARCH function. It gives the ability to search for known record types in a process memory dump or live process’s...

PT-1990-1002 · Hewlett Packard · Vms

Name of the Vulnerable Software and Affected Versions: VMS versions 4.0 through 5.3 Description: The issue allows local users to gain privileges. This is achieved via the ANALYZE/PROCESS DUMP DCL command. Recommendations: For VMS versions 4.0 through 5.3, consider restricting access to the...