> For the complete documentation index, see [llms.txt](https://book.turbosec.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.turbosec.net/memory-analysis.md).

# Memory Analysis

## VMEM dump

Use volatility to get some info about the memory dump

{% hint style="info" %}
Depending if you are using Volatility2 or Volatility3, the commands below might differ but the methodology stays pretty much the same. 
{% endhint %}

{% hint style="warning" %}
While running Vol3, If you run into:\
AttributeError: function/symbol 'ARC4\_stream\_init'\
**Fix**: pip3 install pycryptodome==3.0.0.<br>
{% endhint %}

```
python3 vol.py imageinfo -f Snapshot.vmem
```

Depending on the output, you might be able to enumerate further.

![](https://864121778-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mk3RnfEHBP3zuZMsnli%2F-MkeuGa-mN7feVIN8orj%2F-MkexqaDVSHK929LCeTb%2Fimage.png?alt=media\&token=a7e18e99-4f92-4819-ac89-1462a2914fa6)

```
python3 vol.py -f Snapshot.vmem hashdump 
```