Accessdata: Dump memory for malicious process Deprecated

Deprecated. No available replacement.

Accessdata (Deprecated) · 15 tasks · 2 inputs · 2 outputs

Inputs

  • target_ip —
  • process_name —

Outputs

  • Accessdata.IsProcessDetected — Indicates if the process with the specified name was detected on the agent machine during playbook execution.
  • Accessdata.MemoryDumpPath — The path for the created memory dump file (if not created, it will be an empty string).

Commands used

accessdata-get-jobstatus-memorydump accessdata-get-jobstatus-processlist accessdata-legacyagent-get-memorydump accessdata-legacyagent-get-processlist accessdata-read-casefile

Flowchart

yes Start Start Get process list from legacy agent - accessdata-legacyagent-get-processlist Get process list from leg... accessdata-legacyagent-get-pr... Done Done Read snapshot file from case folder - accessdata-read-casefile Read snapshot file from c... accessdata-read-casefile Check if process exists in process list - AccessdataCheckProcessExistsInSnapshot Check if process exists i... AccessdataCheckProcessExistsI... Does the process exist? Does the process exist? Create memory dump job - accessdata-legacyagent-get-memorydump Create memory dump job accessdata-legacyagent-get-me... GenericPolling - GenericPolling GenericPolling GenericPolling GenericPolling - GenericPolling GenericPolling GenericPolling Get process list job result - accessdata-get-jobstatus-processlist Get process list job result accessdata-get-jobstatus-proc... Get memory dump job result - accessdata-get-jobstatus-memorydump Get memory dump job result accessdata-get-jobstatus-memo... Set playbook output IsProcessDetected - Set Set playbook output IsPro... Set Init playbook output IsProcessDetected - Set Init playbook output IsPr... Set Init playbook output MemoryDumpPath - Set Init playbook output Memo... Set Set playbook output MemoryDumpPath - Set Set playbook output Memor... Set