memory_dump_process
Extract process details from memory dumps by specifying PID and image path, revealing memory regions and loaded DLLs for forensic analysis.
Instructions
Get process info including memory regions and loaded DLLs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID to dump | |
| image_path | Yes | Path to memory dump file | |
| output_dir | No | Directory for output files |