Volatility3 Analyze Ransomware can not make dump of a process

Question

I encountered a problem where I tried to dump a process using volatility3. But volatility3 couldn't do it. Here's the error:
┌──(kali㉿kali)-[~]

└─$ vol -f ../../../mnt/hgfs/BRIC-20251113-181108.raw -o dumps windows.dumpfiles --pid 820

Volatility 3 Framework 2.26.2

Progress: 100.00 PDB scanning finished

Cache FileObject FileName Result

And nothing was found here. Although volatility showed its PID and that the process itself was running. I really need help.

Apichet Janya · Accepted Answer · 2025-11-13 21:33:23Z

0

The command isn’t actually wrong — it’s just the wrong plugin for what you’re trying to do.windows.dumpfiles doesn’t dump the process itself.It only dumps file objects that the process has open at the moment of the memory snapshot. So if that process (PID 820) didn’t have any dumpable file handles, Volatility will show exactly what you got, empty result, even though the process exists. If what you really want is the process memory / executable / VAD regions (which is what you want for ransomware): Use plugins meant for dumping processes, not file objects, e.g.

windows.psscan
windows.pslist
windows.vadinfo
windows.vaddump
windows.memmap
windows.malfind

windows.vaddump or malfind usually gives you what you want. So yeah, nothing 'broken', just the wrong plugin for the job.

answered Nov 13 at 21:33

Apichet Janya

661 silver badge2 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Oleksandr Sydorov Nov 13 at 22:34

I’m trying to dump the memory of a suspicious process using Volatility 3 on Kali Linux. You mentioned using windows.vaddump or malfind for dumping executable/VAD regions — but in my Kali build these plugins are missing, and windows.memmap does not support --dump. So right now I can list processes, but I cannot dump their memory at all. windows.dumpfiles works, but only for file handles, not process memory.

Apichet Janya Nov 13 at 22:46

This is a really common point of confusion, and for a long time the usual advice was indeed “use Volatility 2 for process dumps”. But in recent Volatility 3 releases, Windows process dumping is supported, and it sounds like your Kali package is just too old. Volatility 3 does have process-dump plugins, On a recent Volatility 3 checkout you should see plugins like: windows.procdump # dump the PE image of the process windows.vaddump # dump all VAD regions (full process address space) windows.malfind # dump suspicious/injected memory regions

Collectives™ on Stack Overflow

Volatility3 Analyze Ransomware can not make dump of a process

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related