Crash dumps (MEMORY.DMP, minidumps)

What it is

A crash dump is a copy of memory written when something fails. Kernel crashes (blue screens) produce MEMORY.DMP and/or a small minidump; application crashes can produce user-mode dumps through Windows Error Reporting. Dumps are also created on purpose: administrators debug with them, and attackers dump the memory of lsass.exe to steal credentials. Forensically, a kernel dump is a memory image of the machine at crash time, and any .dmp file of lsass is a strong compromise indicator.

Location

CrashDumpEnabled in CrashControl: 0 none, 1 complete, 2 kernel, 3 small, 7 automatic (the default on Windows 8 and later).

What it proves

• A kernel dump shows what was loaded and running at crash time: processes, drivers (including a malicious or vulnerable driver that caused the crash), network structures and kernel objects.
• A minidump identifies the bug check code and the faulting driver or module.
• A user-mode dump of lsass.exe shows that someone dumped credential memory; its file-system timestamps date the theft attempt.
• A complete dump contains user-mode memory too; a kernel dump does not include user process pages.

Key fields

Timestamps

Retention and clearing

• MEMORY.DMP is overwritten by the next kernel dump (unless Overwrite is disabled); Windows may delete it automatically when disk space is low.
• Minidumps accumulate, oldest removed when the configured number is exceeded.
• Disk Cleanup and WER queue management delete old dumps; attackers delete their LSASS dumps after exfiltrating them, so check the $MFT and USN journal for .dmp files created and deleted.

Collection

• KAPE targets: MemoryFiles (minidumps, plus hiberfil/pagefile) and WER (MEMORY.DMP and other *.dmp in C:\Windows, WER folders, CrashDumps).
• Velociraptor (Windows.Triage.Targets): MemoryFiles, WER.
• Built-in:

reg query HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
dir /s /a C:\*.dmp
wevtutil qe System /q:"*[System[(EventID=1001)]]" /f:text /c:5

Parsing tools

• WinDbg (Microsoft): !analyze -v for the crash cause, lm for loaded modules, .time for the crash time.
• Volatility 3: reads Windows crash dumps as a memory layer and runs the windows.* plugins (process lists, drivers, network).
• MemProcFS (open source): mounts memory images and crash dumps as a file system.
• BlueScreenView (NirSoft): lists minidumps with bug check codes and faulting drivers.

The RAM Parser handles full (complete / kernel) crash dumps directly.

Investigation tips

• Hunt for .dmp files with lsass in the name or an MDMP header anywhere on disk, and for the tools that make them: procdump -ma lsass.exe, rundll32.exe comsvcs.dll, MiniDump, Task Manager's "Create dump file". These are classic LOLBin credential-theft patterns.
• A blue screen right after a new driver was installed can be a failed rootkit or a "bring your own vulnerable driver" attempt: check the faulting module and services.
• Use the kernel dump as a memory image: compare its process and driver lists with Prefetch and Amcache.
• Extract suspicious modules from the dump and triage them as PE files.