Cyber Security Notes

Taking Windows Memory Dump

Cyber Security Notes

Index
Attacking Web Applications
Attacking Web Applications
Binary Exploitation
Binary Exploitation
- How to use GDB
Cryptography
Cryptography
- Pretty Good Privacy (PGP)
- Asymmetric Encryption
  Asymmetric Encryption
  - RSA
    RSA
    
    RSA Attacks
    
    RSA Basics
- Symetric Encryption
  Symetric Encryption
  - AES
    AES
    
    AES Basics
General Pentesting
General Pentesting
- Data Exfiltration
- Miscellaneous Tools
- Miscellaneous Services
- Pivoting
- Port Scanning
- Password Attacks
  Password Attacks
  - Offline Password Attacks
  - Online Password Attacks
Miscellaneous
Miscellaneous
- Machine Learning & AI Attacks
  Machine Learning & AI Attacks
  - Creating Malicious Tensorflow Models
Pentesting Linux
Pentesting Linux
- Priviliage Escalation
- Linux - Stabilisation & Post Exploitation
Pentesting Windows
Pentesting Windows
- Creating Robust Reverse Shells
- Enumerating Windows
- Network Enumeration
- Windows - Stabilisation & Post Exploitation
- Windows Commands
- Windows Local Persistence
- Windows Privilage Escalation
- Windows Tools
- Active Directory
  Active Directory
  - Enumerating Users
  - Hashes & Tokens
    Hashes & Tokens
    
    ASREPRoasting
    
    Dumping Hashes
  - Post Exploitation
    Post Exploitation
    
    Enumaration of Active Directory
  - Remote Management
    Remote Management
    
    evil-winrm
- Windows Services
  Windows Services
  - Pentesting MS-SQL
  - SMB Protocol
Reverse Engineering & Forensics
Reverse Engineering & Forensics
- Memory Analysis
  Memory Analysis
  - MemProcFS
  - Taking Windows Memory Dump Taking Windows Memory Dump
    Table of contents
    
    Enabling a Complete Memory Dump
    
    Creating a Memory Dump
  - Volatility
  - WinDBG
- Reversing Python
  Reversing Python
  - Decompile .elf & .exe Binaries.md

Taking Windows Memory Dump¶

Enabling a Complete Memory Dump¶

Enabling a Complete Memory Dump
Press the Windows key with the letter R to open the run command
Type sysdm.cpl and click Ok to open the System Properties page
Select the Advanced tab
Under Startup and Recovery options choose Settings
From the drop-down menu select Complete memory dump
Note the path where the dump file will be saved for later
Click Ok

Creating a Memory Dump¶

Download and run NotMyFault from the following link: NotMyFault

# To create a memory dump
NotMyFault64.exe /crash

The memory dump will be saved in the path specified in the previous step. It's C:\Windows\MEMORY.DMP by default.

Notice that the memory dump file can be very large, depending on the amount of RAM installed on the system.