D2Winpmem

Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.

javascript · D2 (Deprecated)

Source

//+winpmem/winpmem_2.0.1.exe
try {
  if (env.OS !== 'windows') {
    throw ('script can only run on Windows');
  }
  var arch = wmi_query('select OSArchitecture from win32_operatingsystem')[0].OSArchitecture;
  var exename = 'winpmem_2.0.1.exe';
  var dumpFile = env.TEMP + '\\mem.dump';
  var output = execute(exename + ' -v -o ' + dumpFile, 600); // 10 minutes timeout
  pack(output.Stdout);
  if (output.Success) {
    pack_file(dumpFile);
    del(dumpFile);
  } else {
    throw output.Error;
  }
} catch (ex) {
  pack('Winpmem failed: ' + ex);
}

README

Carries the winpmem binary to a system and returns the memory dump file to the War Room. The amount of time this takes will depend on the amount of RAM in the target system.

Script Data

Name	Description
Script Type	javascript
Tags	agent, memory, forensics

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.