1

Can Cuckoo extract PE files from a memory dump or record the import table of the running process? I need to record the import table in PE not the called/executed API from the process.

There is Process-Dump which is able to extract PE from memory, So can Cuckoo has a feature to do the same task?

Improve this question

1 Answer 1

Reset to default
1

Yes, Cuckoo can extract PE files from memory dumps. In addition, Cuckoo also has the capability to record the import table of a running process, as well as the called/executed API from the process. This can be done through the use of the Cuckoo Memory Dump module.

Improve this answer
2
  • For extracting PE after taking memory.dmp? If yes, shall I use another app to extract from the memory dump?
    – 0xh3xa
    Dec 4, 2022 at 16:40
  • Also, do you know which property/code is responsible for recording the import table? I have looked at the documentation and have yet to find it.
    – 0xh3xa
    Dec 4, 2022 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .