Windows tool for dumping malware PE files from memory back to disk for analysis.
Deep memory analysis for Windows processes — the tool that saves you hours of debugging
Protected Process Dumper Tool
DMA PE (Portable Executable) Dumper with DTB patching capabilities.
dll decryptor — dumps encrypted DLL payloads, resolves imports, rebuilds PE headers, exports or memory-maps the decrypted module
The multi-platform memory acquisition tool.
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).