Malware authors often use process dumps to capture the contents of running processes in memory. This technique allows them to extract sensitive data, such as decrypted passwords, cryptographic keys, or other valuable information.

Featured Windows APIs

• OpenProcess Kernel32.dll
• MiniDumpWriteDump Dbghelp.dll
• ReadProcessMemory Kernel32.dll
• VirtualQueryEx Kernel32.dll

Associated Features

Feature Name	Dangerousness	Key Categories
Process Manager	Medium	Disruption, System Management
Password Recovery	High	Privilege Escalation, Lateral Movements, Credentials