This is the Windows app named MemProcFS Analyzer whose latest release can be downloaded as MemProcFS-Analyzerv1.2.0sourcecode.tar.gz. It can be run online in the free hosting provider OnWorks for workstations.
Download and run online this app named MemProcFS Analyzer with OnWorks for free.
Follow these instructions in order to run this app:
- 1. Downloaded this application in your PC.
- 2. Enter in our file manager https://www.onworks.net/myfiles.php?username=XXXXX with the username that you want.
- 3. Upload this application in such filemanager.
- 4. Start any OS OnWorks online emulator from this website, but better Windows online emulator.
- 5. From the OnWorks Windows OS you have just started, goto our file manager https://www.onworks.net/myfiles.php?username=XXXXX with the username that you want.
- 6. Download the application and install it.
- 7. Download Wine from your Linux distributions software repositories. Once installed, you can then double-click the app to run them with Wine. You can also try PlayOnLinux, a fancy interface over Wine that will help you install popular Windows programs and games.
Wine is a way to run Windows software on Linux, but with no Windows required. Wine is an open-source Windows compatibility layer that can run Windows programs directly on any Linux desktop. Essentially, Wine is trying to re-implement enough of Windows from scratch so that it can run all those Windows applications without actually needing Windows.
SCREENSHOTS
Ad
MemProcFS Analyzer
DESCRIPTION
MemProcFS-Analyzer is a PowerShell script intended to simplify and automate forensic analysis of memory dumps (raw memory or crash dumps) on Windows. It builds on MemProcFS (which provides a virtual file system to mount memory), integrating many parsing tools and capabilities (YARA, ClamAV, parsers for Windows artifacts, event logs etc.), generating output (timelines, alerts, reports), and facilitating examination of anomalies in process behavior, injected modules, masquerading, unusual parent-child relationships etc.
Features
- Auto-install and auto-update of many dependent tools such as MemProcFS itself, AmcacheParser, AppCompatCacheParser, EvtxECmd, YARA, Kibana etc.
- Supports mounting memory snapshots (physical or crash dumps) like disk images, handling Windows “pagefile” support and compression features
- OS fingerprinting, browsing process tree with parent-child chain, detection of process path/name masquerading and unusual user contexts
- Ability to scan with custom YARA rules and built-in YARA rule sets, multi-threaded scans with ClamAV on Windows
- Extraction of Windows artifacts: registry, event logs (EVTX), browser histories, Amcache, ShimCache, Prefetch, LNK shortcuts etc.
- Reports / outputs in CSV, organizing suspicious files for further analysis, archiving evidence, timeline generation etc.
Programming Language
PowerShell
Categories
This is an application that can also be fetched from https://sourceforge.net/projects/memprocfs-analyzer.mirror/. It has been hosted in OnWorks in order to be run online in an easiest way from one of our free Operative Systems.
