Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...


Yes, it is possible to analyze a kernel mode dump in WinDBG: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg

But analyzing it takes a little more finesse than a per-process level dump. See how to interrogate all running processing with !process: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-process, etc.

  • unfortunately this is not a kernel dump (in .dmp file extension), this is a pure raw dump memory made by RamCapture (Belkasoft). WinDBG doesn't support raw dump. – Bernie Simpsons Jan 5 at 8:55
  • The proprietary software is good to know. .dmp files are the de facto standard for memory forensics. It appears you have a tool that's trying to force you to only use their products as the product sheet says you need to use their proprietary tool to analyze the dump created by RAM Capturer:. belkasoft.com/ram-capturer – thepip3r Jan 7 at 15:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.