> For the complete documentation index, see [llms.txt](https://book.turbosec.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.turbosec.net/memory-analysis.md).

# Memory Analysis

## VMEM dump

Use volatility to get some info about the memory dump

{% hint style="info" %}
Depending if you are using Volatility2 or Volatility3, the commands below might differ but the methodology stays pretty much the same. 
{% endhint %}

{% hint style="warning" %}
While running Vol3, If you run into:\
AttributeError: function/symbol 'ARC4\_stream\_init'\
**Fix**: pip3 install pycryptodome==3.0.0.<br>
{% endhint %}

```
python3 vol.py imageinfo -f Snapshot.vmem
```

Depending on the output, you might be able to enumerate further.

![](/files/-MkexqaDVSHK929LCeTb)

```
python3 vol.py -f Snapshot.vmem hashdump 
```