Create memory dump from the windows commandline

Question

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is required in newer windows version.

Is there a known way to get around this problem without using a GUI?

As far as I remember, [WinPmem](https://github.com/google/rekall/releases) does not require a GUI. — user2313067, Dec 31 '15 at 01:13
I was trying to do the same and someone pointed me to the usage of the built in Werfault.exe — P3nT3ster, Dec 30 '15 at 13:30
Is this a virtual machine? If so, take a snapshot and convert it to a memory image. Another option is to configure the OS to perform a full memory dump and create a BSOD yourself. — user2320464, Jan 02 '16 at 01:41

score 1 · Accepted Answer · answered Dec 31 '15 at 07:01

1

For doing a memory dump, you can use DumpIt and read the dump with volatility.

answered Dec 31 '15 at 07:01

Sorcha

595
2
5

Create memory dump from the windows commandline

1 Answers1