FOR-LAB//LIVE

Case2024-RX-912WINDESKTOP-R7K2L9PhaseVOLATILE

Score090

WinPmem 4.0 RCWIN

Raw / AFF4RECOMMENDED

Kernel driver, signed, robust against AV interference.

Best forHostile Windows endpoints where EDR may interfere with userland dumpers.

Driver load is logged — note PID & timestamp in custody before execution.

4 guided steps · click to load

DumpIt (Comae)WIN

Raw / Crash

Single-binary, default to raw, /force for hostile hosts.

Best forFast triage where you need a single self-contained executable.

Defaults to MS crash dump — pass /R for raw if you plan to run Volatility.

4 guided steps · click to load

Magnet RAM CaptureWIN

Raw

GUI capture, low footprint, Magnet integration.

Best forField investigators who need a guided GUI and AXIOM ingestion.

GUI screenshots ARE part of the evidence — capture each dialog.

4 guided steps · click to load

Belkasoft RAM CapturerWIN

Raw

Bypasses common anti-dump techniques.

Best forTargets running anti-forensic drivers that block standard tools.

Match x86/x64 binary to target architecture or the driver will not load.

4 guided steps · click to load

LiME (Linux)LIN

LiME / PaddedOS MISMATCH

LKM; requires matching kernel headers.

Best forLinux hosts where you control kernel headers and can load an LKM.

Kernel header mismatch = insmod fails. Verify `uname -r` first.

4 guided steps · click to load

AVML (Microsoft)LIN

AVMLOS MISMATCH

Userland, no driver, portable across kernels.

Best forCloud / container Linux hosts where loading an LKM is impossible.

Requires CAP_SYS_PTRACE — run as root or with sudo.

4 guided steps · click to load

OSXPmemMAC

AFF4 / RawOS MISMATCH

Requires SIP considerations; signed kext.

Best formacOS hosts where you can authorize a third-party kernel extension.

SIP must allow the kext OR boot in Recovery; document the choice.

4 guided steps · click to load

V.4.2.0-STABLE

Target host

Windows 10 Pro 19045

DESKTOP-R7K2L9·10.0.4.122·16 GiB·up 04:12:09

Ransomware Active

Idle — ready to acquire [WinPmem 4.0 RC]0.0% complete

Streaming SHA-256485fc2ebc8cb3646008f4fc72cf77562d55fb51dbb4c260d8c438ccadb9d5b32

Bytes written0 / 17,179,869,184

VM Console · DESKTOP-R7K2L910.0.4.122 · WIN

Live processes (top)

svchost.exe (4402)38.1%
encryptor.bin (9912)71.4%
lsass.exe (712)1.2%
svchost.exe (2204)2.4%
taskhostw.exe (884)0.4%

Memory artifacts

AES-256 key fragment @ 0x7ffd1042
Logged user: vaughn
BitLocker FVEK in nonpaged pool
Clipboard: "$AdminPass2024!_"

Constraints

Low disk space on C:
EDR may intercept driver load
T+10 min auto-reboot scheduled

RAM pressure 40%CPU 22%NET ↑ 80 KB/scapture 0.0%

Forensic shell · pid 0xA1 · ttyS0

$ for-lab --connect target://DESKTOP-R7K2L9

[+] Secure channel established · TLS-1.3 · cert OK

[+] Target profile loaded · Windows 10 Pro 19045

[!] Ransomware indicator active — recommend volatile capture first.

$