> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Crash Dump Analysis with WinDbg

> Analyze Windows crash dumps (.dmp) using the WinDbg MCP on VM4.

```
Analyze the crash dump at C:\dumps\crash.dmp using WinDbg MCP:

1. Use windbg MCP to open and analyze C:\dumps\crash.dmp
2. Get the exception record and faulting address
3. Get the call stack at time of crash
4. List loaded modules and check for suspicious ones
5. Check if any known malicious modules are present
6. Cross-reference any suspicious hashes with virustotal get_file_report
7. Summarize: crash cause, faulting module, indicators of compromise
```

> [!TIP]
>
> Crash dumps can come from malware that crashes the host process (e.g., shellcode injection failures) or from intentional `MiniDumpWriteDump` calls by the malware itself. Either way, the dump often contains decrypted strings and config in memory that static analysis misses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.