Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...

  • Typical tools for this are Volatility or Rekall. There are some useful things you can do in WinDbg, but I’d focus on those other tools first as they can directly answer your questions. – David Feb 2 at 22:55

Yes, it is possible to analyze a kernel mode dump in WinDBG: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg

But analyzing it takes a little more finesse than a per-process level dump. See how to interrogate all running processing with !process: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-process, etc.

  • unfortunately this is not a kernel dump (in .dmp file extension), this is a pure raw dump memory made by RamCapture (Belkasoft). WinDBG doesn't support raw dump. – Bernie Simpsons Jan 5 at 8:55
  • The proprietary software is good to know. .dmp files are the de facto standard for memory forensics. It appears you have a tool that's trying to force you to only use their products as the product sheet says you need to use their proprietary tool to analyze the dump created by RAM Capturer:. belkasoft.com/ram-capturer – thepip3r Jan 7 at 15:08

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.