Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...

  • Typical tools for this are Volatility or Rekall. There are some useful things you can do in WinDbg, but I’d focus on those other tools first as they can directly answer your questions.
    – David
    Feb 2, 2019 at 22:55
  • If you update your question to explain what you mean by "full raw dump memory" you might get better answers.
    – hft
    Sep 25, 2020 at 5:26

1 Answer 1


Yes, it is possible to analyze a kernel mode dump in WinDBG: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg

But analyzing it takes a little more finesse than a per-process level dump. See how to interrogate all running processing with !process: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-process, etc.

  • unfortunately this is not a kernel dump (in .dmp file extension), this is a pure raw dump memory made by RamCapture (Belkasoft). WinDBG doesn't support raw dump. Jan 5, 2019 at 8:55
  • The proprietary software is good to know. .dmp files are the de facto standard for memory forensics. It appears you have a tool that's trying to force you to only use their products as the product sheet says you need to use their proprietary tool to analyze the dump created by RAM Capturer:. belkasoft.com/ram-capturer
    – thepip3r
    Jan 7, 2019 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.