Guide to Capturing and Handling Live-Process Memory Evidence
Summary
A practical guide to capturing live-process memory, verifying identity and evidence integrity, interpreting coverage and limitations, and protecting sensitive dumps. It describes supported formats and safe handling workflows.
Key points
- Capture one exactly identified live process per operation; supported targets are x86 or x64 processes on Windows x64, with a 1 GiB limit per primary artifact.
- Six formats are available; only Raw Process Memory Image and MalwareInfo Custom Memory Format may retain explicitly labeled partial evidence.
- Memory dumps can expose credentials, tokens, keys, private documents, and other sensitive data; keep raw evidence in protected storage and avoid public scanners or ordinary sharing channels.
- Use an authorized, disposable, isolated analysis VM for unknown or suspicious processes; the capture workflow is not a sandbox and does not undo target-process changes.
- Review status separately from coverage, and preserve the manifest, process identity, artifact length, SHA-256, diagnostics, and limitations.
- Captured bytes, strings, or structures do not prove execution or malicious intent; distinguish static findings, observed memory, runtime evidence, and analyst inference.
- Use the verified handoff to Payload & Memory Analyzer, which reads selected artifacts without executing them.
Article Details
- Topic
- Process memory capture workflow for preserving and analyzing live-process evidence, with guidance on capture formats, identity verification, coverage, integrity, privacy, and evidence interpretation.
Products
Malware INFOProcess Memory Capture is a Malware INFO Enterprise workflow for preserving point-in-time evidence from one exactly identified live process.Malware INFO EnterpriseProcess Memory Capture is a Malware INFO Enterprise workflow for preserving point-in-time evidence from one exactly identified live process.