ai-agent

MemProcFS-Analyzer: Simplify DFIR

Name: MemProcFS-Analyzer: Simplify DFIR
Author: LETHAL-FORENSICS

Get automated forensic analysis of Windows memory dumps with MemProcFS-Analyzer, a tool for startup founders in digital forensics and incident response.

723 stars76 forksPowerShellQuality 8/10Updated 5/2/2026100% free · open source

What it does

MemProcFS-Analyzer provides automated forensic analysis of Windows memory dumps to help identify potential security threats and understand system behavior

Install / run

Download and extract the latest release from https://github.com/LETHAL-FORENSICS/MemProcFS-Analyzer/releases

When to use it

•When analyzing a Windows system for malware or unauthorized access
•During incident response to understand the scope of a security breach
•To inspect a Windows system's memory for suspicious activity or configuration issues

Quick start

1Extract the downloaded zip file to a directory, such as C:\MemProcFS-Analyzer
2Open a PowerShell prompt as an administrator and navigate to the extracted directory
3Run the command '.\MemProcFS-Analyzer.ps1 -h' to view help and usage information
4Use the command '.\MemProcFS-Analyzer.ps1 -f <memory_dump_file>' to analyze a Windows memory dump
5Review the generated report for indications of malicious activity or system misconfiguration

Ready-to-paste prompt

.\MemProcFS-Analyzer.ps1 -f C:\path\to\memory.dmp -o C:\path\to\output

Heads up: The system must have PowerShell 3 or later installed, and the MemProcFS-Analyzer script must be run with administrative privileges to access the Windows memory dump files

Saves to your device