Memory forensics
Index a Windows memory dump on the host with engram and investigate it from mlab.sh: processes, injected code, network, persistence, registry, files, kernel, YARA.
The Memory tab of a workspace lists the memory dumps your agents can see, builds an index of the one you pick, and opens it in the memory explorer. The dump stays on the host: engram analyses it there, and every read or extraction goes back to the agent, under its policy.
Supported dumps
| Systems | Windows 10 and 11, Windows Server 2016 to 2025, x64 (32-bit processes on 64-bit Windows included) |
| Formats | raw (.raw .mem .bin .img .dmp), Windows crash dumps, hibernation files (hiberfil.sys), LiME and AVML, ELF cores (QEMU, Xen), QEMU snapshots (.sav .vmstate), VMware (.vmem), EWF images (.E01), and these compressed in .gz or .zip |
| Paging files | put the host's pagefile.sys and swapfile.sys next to the dump as <dump>.pagefile.sys and <dump>.swapfile.sys: pages moved to disk become readable |
| Not yet | pages held in the Windows memory compression store, Linux and macOS memory |
Only files directly inside the folders the policy lists (dump_dirs) are visible; symbolic links are ignored. engram downloads Windows symbols from Microsoft's public symbol server and caches them; for hosts without Internet access, symbols can be packed elsewhere and imported (symbols_offline = true).
Indexing
Click Index next to a dump. The agent analyses it on the host and reports its progress; a few seconds for a small dump, minutes for a large one, and the build keeps going if the agent reconnects meanwhile. The index (processes, modules, memory map, threads, handles, network, registry, findings...) is encrypted and stored by mlab.sh for the workspace's data holding period. Re-index rebuilds it (the previous one stays open meanwhile); Delete index forgets it (owners and admins).
The explorer
| Tab | What it shows |
|---|---|
| Processes | The process tree, with leads on each process and a filter. Click a process for its modules (with build date and debug info), memory map, threads, handles, token and privileges, environment. |
| Findings | Injected or hollowed code, patched functions, hooks and other anomalies, worst first. |
| Network | TCP connections, listening ports and UDP endpoints with their process, closed ones included. Public addresses open in mlab.sh IP intelligence. |
| Persistence | Autoruns (Run and RunOnce keys of the machine and every user, Winlogon, AppInit, Image File Execution Options, BootExecute, LSA packages), services, scheduled tasks, each with its last write time. |
| Registry | Every hive held in memory; open any key, its subkeys and values, read live from the host. |
| Files | The files the system had open, as a folder tree with counts, filters for executables and user-writable folders, and search. |
| Kernel modules | Loaded drivers, driver objects whose dispatch routines point outside their own image, notify routines, hooked system services. |
| Memory | A hex view of process or physical memory, read live from the host one page at a time. Unreadable bytes are hatched, never shown as zeros. |
| YARA | Your rules over the memory of every running process, or one; long scans run in the background. |
| Gaps | What the dump does not hold (paged out, compressed) and how to get more of it. |
Every table exports to CSV.
Leads
Leads are hints to look at first, never verdicts. High (red) means look now, medium (amber) worth a look.
| Lead | Meaning |
|---|---|
| Odd parent | A core Windows process started by an unexpected parent |
| Office child | A command interpreter or LOLBin started by an Office application |
| Encoded command | An encoded or obfuscated command line |
| Reads lsass | A handle that can read the memory of lsass (credential theft) |
| Injected code, Injected PE, Shellcode | Executable private memory, holding a PE image or code |
| Hollowed image, PEB masquerade | An image replaced in memory, or a process lying about its path |
| Unbacked thread | A thread starting outside any loaded image |
| Unlinked image, Loader list gap | A module hidden from the loader's lists |
| Hidden process | A process found in memory but missing from the active list |
| LOLBin, User folder | A living-off-the-land binary, or a binary run from a folder users can write to |
Findings also cover patched ETW and AMSI functions, import table hooks, code pages that differ from their image on disk, executable pages in non-executable memory, suspended threads, and kernel hooks.
Pulling things out
Each module, memory region and finding has View (the hex view at that address) and a ⋯ menu:
| Action | Result |
|---|---|
| Extract (memory) | The executable image as mapped in memory (sections at their virtual addresses): for a disassembler loaded at this base. |
| Extract (file) | The same image rebuilt in file layout (sections at their file offsets): for PE tools and file scanners. |
| Dump region | The raw bytes of a memory region, up to 256 MB. |
| Scan in mlab | The image (file layout) goes to the file analysis as a private report of your organization, opened in a new tab. |
Downloads are .bin files with their SHA-256; never run them. Each extraction is in the audit log, on mlab.sh and on the host.
Extraction, region dumps and indexing upload their result: the agent's policy must allow those operations and the upload host (the Policy editor fills it in).