Memdump is a powerful tool for dumping the memory of a running system. If it is not currently installed on the system, it can be easily installed with the help of the package manager:
apt install memdump
As seen in the image above, the installation of Memdump has been completed successfully.
You can direct the output of the memdump command to a file to write the memory dump to a file. The following command saves the memory dump to the file “memdumptest”:
memdump > memdumptest
You can start analyzing this file with a hex editor tool or with the “strings” command.
If you need you can more details on this Malware Anti-Analysis Techniques course.
.png)
.png)
.png)