dmpHunter — Hunt indicators inside Windows mini/full process dumps: memory maps, handles, threads, modules (+ IAT), strings, sockets↔threads, YARA, and surgical VA-range dumping.
Current version: v0.2.0 · GitHub Repository
CLI Aliases
Features
Mini & Full Dump Support
Unified VA→file mapping from MemoryList, Memory64List, and Thread stacks.
Memory Map
Decoded protection, start/end VAs, CSV/JSON export.
Handles
Decoded access masks (process & thread), verify
PROCESS_SUSPEND_RESUME.Threads
TEB and StackStart/StackEnd per thread.
Modules & IAT
Full import table parsing per module.
Strings
ASCII + UTF-16LE, VA-range scanning, and command-line heuristics.
YARA
Streaming scan over selected regions — no huge allocations.
Network Heuristics
Socket-like handles correlated to threads + endpoint extraction from stacks.