Memory Acquisition

Walkthrough summary

Memory Acquisition TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• What is the file name that contains the memory of a hibernated Windows system? The answer is in the format: filename.extension
  Open the walkthrough page to inspect the full answer and command flow.
• Which tool can you use to obtain a process memory dump on a linux host?
  Open the walkthrough page to inspect the full answer and command flow.
• Start notepad.exe on the VM and use the procdump64.exe tool to write a 'triage' dump file of the process. Ensure that the dump file's name is formatted like PROCESSNAME_PID_YYMMDD_HHMMSS.dmp. Enter the complete command below. Note: Use PowerShell so to syntax is correct. No need to include the -accepteula flag
  Open the walkthrough page to inspect the full answer and command flow.
• Which two tools can you use to extract or dump memory artifacts of the lsass.exe process? Enter the answers in alphabetic order, separated by a comma, and in the same format they are mentioned in the task.
  Open the walkthrough page to inspect the full answer and command flow.
• Modify the following command to ensure the memory dump is in the .raw format and is accessible over TCP port 5555: sudo insmod lime-6.8.0-1027-aws.ko "path=/tmp/memdump.lime format=lime"
  Open the walkthrough page to inspect the full answer and command flow.