WinPmem Hands on Labs

Interactive Lab

Browser based

WinPmem Interactive Lab

Expand labOpen in new tab

✓ No installation

Practise a scoped memory acquisition in an Administrator Command Prompt: check the endpoint, acquire, compare a working copy and write a bounded handover.

CASE SUSA-052 · 8 to 12 MINUTES

Keep the volatile evidence before it disappears.

Unexpected PowerShell activity was reported on WIN11-LAB. Acquire its memory for later analysis, preserve a checked copy, and hand over an honest acquisition record.

Beginner · guided command line practice

Your acquisition plan

Authorised endpoint

WIN11-LAB · Windows x64 · 16 GiB RAM

Prepared evidence volume

D: · EVIDENCE · 64 GiB free

Case folders already exist

D:\SUSA-052\memory
D:\SUSA-052\Working

Tool already verified for this case

C:\Tools\WinPmem\winpmem_mini_x64.exe

The case records already establish authority, tool provenance and compatibility. You are in an elevated Command Prompt. Keep the live endpoint running while collecting; acquisition itself changes its memory.

Browser simulation only: no commands execute, no driver loads and no memory is accessed. This reproduces the legacy mini executable shown in the guide, with abbreviated, fictional output. Other releases have different names and options; follow your retained build's documentation in the Full Lab.

1. 1Check context
2. 2Acquire RAM
3. 3Preserve & compare
4. 4Handover

YOUR NEXT MOVE

Check that you are on the authorised endpoint.

Confirm the host before running an acquisition tool.

hostname

Copy the command, click the prompt and paste with Ctrl+V, then press Enter.

Why this step?

Administrator: Command Prompt−　□　×

Microsoft Windows [Version 10.0.22631.4317]
(c) Microsoft Corporation. All rights reserved.

C:\Tools\WinPmem>

Run command

Full Lab

Self hosted / real acquisition

WinPmem Full Lab

Windows VM + evidence disk

Case SUSA-052 / preserve the volatile lead

Capture it. Check it. Hand it over.

A responder reports unusual PowerShell activity on a Windows workstation. Your job is to preserve its live memory before a planned restart, check a saved working copy, and give the next analyst a usable evidence trail. Practise on your own disposable VM; no malware is needed.

Tick a checkpoint only after saving its evidence. Progress is self reported; this page cannot check your VM.

Investigation brief

Case questionCan another analyst identify, check and analyse the memory image we preserved?

Collection scope

One authorised Windows x64 VM; live physical memory to a separate evidence disk. The reported PowerShell activity is a lead for later analysis.

Real case note: Assume the response lead has already approved collection and containment. In an incident, agree those decisions with the team; active harm may change priorities. WinPmem loads a driver and changes the live system. Memory keeps changing during capture.

Before you start

Need: a disposable Windows x64 VM, administrator access, Windows PowerShell 5.1, a clean snapshot, and a verified WinPmem mini build at C:\Tools\WinPmem\winpmem_mini_x64.exe that works with your VM. A small VM with about 4 GiB RAM and a separate 64 GiB NTFS evidence disk mounted as D: keeps capture and copying manageable.

Run: copy the blocks in order into one Windows PowerShell window opened as administrator. Check each Look for result. Plan roughly 30 to 45 minutes after setup; capture and hashing time depend on your VM and storage. You do not need a memory analysis tool for the core handover.

Need setup or version help?

Follow Install and open and Capture and verify. Check that D: is the separate training evidence disk, not a system/recovery volume. Save the snapshot before this exercise; arrange to retain the evidence disk outside rollback.

The project's mini instructions use a destination filename and RAW output. The release notes distinguish mini/test builds from the signed Go executable recommended there for production; their interfaces differ. Do not rename a Go executable to mini or copy these commands into a different build. If the retained driver is blocked, stop and review compatibility; changing Secure Boot or driver signing settings is outside this beginner lab.

The browser lab uses Command Prompt. This full lab uses Windows PowerShell to save context and logs; it invokes the same mini acquisition interface.

Activity 1: Prepare the capture

Your first winKnow exactly which VM, executable and destination your case will use.

1. Check the VM and create a fresh case

Open Windows PowerShell as administrator on the disposable VM. GiB means 1,073,741,824 bytes. The free space check is a planning cushion for the image and its copy, not a guarantee: RAW address gaps can make an image larger than installed RAM.

$wpmCase = 'D:\SUSA-052'
$wpmTool = 'C:\Tools\WinPmem\winpmem_mini_x64.exe'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
if (-not [Environment]::Is64BitOperatingSystem) { throw 'Use the prepared Windows x64 VM.' }
$wpmAdmin = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-not $wpmAdmin.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Open PowerShell as administrator.' }
if (-not (Test-Path -LiteralPath $wpmTool -PathType Leaf)) { throw 'Verified mini executable not found.' }
$wpmRam = [int64](Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
$wpmDisk = Get-Volume -DriveLetter D -ErrorAction Stop
if ($env:SystemDrive -eq 'D:' -or $wpmDisk.FileSystem -ne 'NTFS') { throw 'Use the separate NTFS evidence disk on D:.' }
if ($wpmDisk.SizeRemaining -lt (3 * $wpmRam)) { throw 'Allow more room for the RAW image, working copy and logs.' }
if (Test-Path -LiteralPath $wpmCase) { throw 'Case already exists. Choose a fresh case folder; retain earlier attempts.' }
New-Item -ItemType Directory -Path "$wpmCase\memory", "$wpmCase\working", "$wpmCase\logs" -ErrorAction Stop | Out-Null
@(
    'Case: SUSA-052; authority: this disposable VM only'
    "Operator: $env:USERNAME; VM: $env:COMPUTERNAME"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o'))"
    "Time zone: $((Get-TimeZone).Id)"
    "Installed RAM bytes: $wpmRam"
    "Destination: D:; label: $($wpmDisk.FileSystemLabel); free bytes: $($wpmDisk.SizeRemaining)"
    "Tool path: $wpmTool"
) | Set-Content -LiteralPath "$wpmCase\case-context.txt"
Get-FileHash -Algorithm SHA256 -LiteralPath $wpmTool |
    Export-Csv -LiteralPath "$wpmCase\tool-sha256.csv" -NoTypeInformation
Get-Content -LiteralPath "$wpmCase\case-context.txt"

Look for: your actual VM name, RAM and evidence disk space. No need to rename the VM to WIN11-LAB; the image filename is a training label. Open case-context.txt in Notepad and add the snapshot name, tool release, download URL/date, compatibility check, and who authorised this training acquisition. A locally calculated tool hash identifies the binary; compare it with a trusted published value where available.

2. Plant a harmless PowerShell lead

For this training case, open a second ordinary Windows PowerShell window on the same VM. Run the block below there and leave that window open until acquisition finishes. It only labels the window and records its PID (process ID); it does not download or contact anything.

$Host.UI.RawUI.WindowTitle = 'SUSA-052 harmless PowerShell lead'
@(
    'Training only: intentionally opened PowerShell, not malicious activity'
    "PID: $PID"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o'))"
) | Set-Content -LiteralPath 'D:\SUSA-052\training-lead.txt'
Get-Content -LiteralPath 'D:\SUSA-052\training-lead.txt'

Look for: the labelled window and a saved PID. Return to your first, administrator window for Activity 2. This known process gives a later analyst a small validation target; its presence does not establish malicious behaviour. In a real incident, you record observed leads rather than create training activity on the suspect host.

Ready to capture I saved the VM, authority, snapshot, tool provenance/hash and separate disk details. I saved the harmless lead's PID and time and left its window open.Pause point: you can pause before capture. If you close the lead, repeat Step 2 and record its new PID/time. If you changed the case path, change it in the second window block too.

Next: preserve the live memory and the acquisition messages.

Continue to capture ›

Activity 2: Acquire and check

Your next winKeep a memory image together with its command, timing and capture log.

Make your call

If the command finishes and a RAW file exists, is that enough to promise every memory page was captured? Predict what you still need to check.

1. Capture to a new filename and keep the console log

Run this in the first, administrator PowerShell window. RAW is the saved memory format; WinPmem acquires memory, it does not analyse the PowerShell lead. Tee-Object displays messages and saves them to a text log.

Set-Location 'C:\Tools\WinPmem' -ErrorAction Stop
$wpmAttempt = 'WIN11-LAB'
$wpmImage = Join-Path "$wpmCase\memory" "$wpmAttempt.raw"
$wpmLog = Join-Path "$wpmCase\logs" "$wpmAttempt-console.txt"
$wpmRunNote = Join-Path "$wpmCase\logs" "$wpmAttempt-acquisition.txt"
if ((Test-Path -LiteralPath $wpmImage) -or (Test-Path -LiteralPath $wpmLog) -or (Test-Path -LiteralPath $wpmRunNote)) { throw 'Attempt already exists. Retain it and use a fresh attempt name.' }
$wpmStart = (Get-Date).ToUniversalTime().ToString('o')
@("Command: $wpmTool $wpmImage", "Start UTC: $wpmStart") |
    Set-Content -LiteralPath $wpmRunNote
& $wpmTool $wpmImage 2>&1 | Tee-Object -FilePath $wpmLog
$wpmExit = $LASTEXITCODE
$wpmFinish = (Get-Date).ToUniversalTime().ToString('o')
@("Finish UTC: $wpmFinish", "Exit code: $wpmExit") |
    Add-Content -LiteralPath $wpmRunNote
Get-Content -LiteralPath $wpmRunNote

Look for: driver/acquisition messages, then a returned PowerShell prompt, finish time and exit code. Treat a nonzero code, read errors, driver failure or write/space failure as a problem to investigate. Even a zero code is not a completeness guarantee. Keep the training window open until the capture returns; avoid other activity during acquisition.

2. Inspect the saved image and record its fingerprint

Review the complete console log first. Continue only after the run has returned and you have accounted for errors. SHA-256 is a fingerprint of the saved file's bytes; it is not a comparison with live RAM.

if ($wpmExit -ne 0) { throw 'Retain and investigate the failed attempt before continuing.' }
$wpmFile = Get-Item -LiteralPath $wpmImage -ErrorAction Stop
if ($wpmFile.Length -eq 0) { throw 'Empty image. Keep the log and investigate.' }
$wpmFile | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$wpmCase\image-details.csv" -NoTypeInformation
Get-FileHash -Algorithm SHA256 -LiteralPath $wpmImage -ErrorAction Stop |
    Export-Csv -LiteralPath "$wpmCase\image-sha256.csv" -NoTypeInformation
Import-Csv -LiteralPath "$wpmCase\image-details.csv" | Format-List
Import-Csv -LiteralPath "$wpmCase\image-sha256.csv" | Format-List

Look for: the expected path, a nonzero byte size and a 64-character SHA-256. Your size and hash will differ from the browser simulation. Physical address gaps may be padded, so image size need not equal installed RAM. A surprising size calls for reviewing ranges and errors; size alone cannot validate completeness. Add your log review and any warnings to the acquisition note.

Something failed or the capture was interrupted

What you see	Your next move
Driver blocked / access denied	Check administrator rights and the exact retained build's compatibility. Stop if the driver remains blocked; keep the error for review.
Write error / disk full	Retain the partial image and log. Check the evidence disk and room for padded output plus its copy.
Cancelled run / no finish record	Record cancellation time and what happened in the attempt note. A partial file is not a completed acquisition.
Nonzero exit / read warnings	Record the messages and limits; consult the exact build's documentation before deciding whether to retry.

For an approved retry, keep the old attempt, change $wpmAttempt = 'WIN11-LAB' to a fresh name such as 'WIN11-LAB-retry01' in Step 1, and rerun that block followed by Step 2. Record the reason and resolution in both attempt notes. Never overwrite the partial image to create an apparent success.

Acquisition preserved I retained the image, exact command, UTC start/finish, exit code and console log; I recorded any warnings or failed attempts. I reviewed the log and saved the completed image's path, byte size and SHA-256.Pause point: after these checks, close the labelled training window. Activity 3 uses the saved file. A failed capture is useful troubleshooting evidence, but does not meet the completed image checkpoint.

Next: check an analysis copy and decide what the evidence supports.

Continue to handover ›

Activity 3: Verify and hand over

Your final winGive another analyst a matching working copy and an honest acquisition note.

Returning in a new PowerShell window?

Set $wpmCase = 'D:\SUSA-052' using your actual case folder. Step 1 reloads the saved original path and fingerprint; no new acquisition is needed. Keep the original closed to analysis and work from the copy.

1. Create and verify a working copy

Copying and hashing may take several minutes. First check the original against its recorded fingerprint. Then compare the new working copy with that same fingerprint.

$wpmRecorded = @(Import-Csv -LiteralPath "$wpmCase\image-sha256.csv")
if ($wpmRecorded.Count -ne 1) { throw 'Expected one image fingerprint. Inspect the saved record.' }
$wpmImage = $wpmRecorded[0].Path
$wpmOriginal = Get-FileHash -Algorithm SHA256 -LiteralPath $wpmImage -ErrorAction Stop
if ($wpmOriginal.Hash -ne $wpmRecorded[0].Hash) { throw 'Original differs from its recorded fingerprint. Retain the discrepancy and investigate.' }
$wpmWorking = Join-Path "$wpmCase\working" ([IO.Path]::GetFileName($wpmImage))
if (Test-Path -LiteralPath $wpmWorking) { throw 'Working copy already exists. Check it separately; do not overwrite it.' }
$wpmImageBytes = (Get-Item -LiteralPath $wpmImage).Length
if ((Get-Volume -DriveLetter D).SizeRemaining -lt ($wpmImageBytes + 1GB)) { throw 'Not enough room for this actual image and a log cushion.' }
Copy-Item -LiteralPath $wpmImage -Destination $wpmWorking -ErrorAction Stop
$wpmCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $wpmWorking -ErrorAction Stop
[pscustomobject]@{
    Original = $wpmImage
    WorkingCopy = $wpmWorking
    RecordedSHA256 = $wpmRecorded[0].Hash
    OriginalSHA256 = $wpmOriginal.Hash
    CopySHA256 = $wpmCopyHash.Hash
    Match = $wpmCopyHash.Hash -eq $wpmRecorded[0].Hash
} | Export-Csv -LiteralPath "$wpmCase\working-copy-check.csv" -NoTypeInformation
Import-Csv -LiteralPath "$wpmCase\working-copy-check.csv" | Format-List
if ($wpmCopyHash.Hash -ne $wpmRecorded[0].Hash) { throw 'Copy mismatch. Preserve the comparison and resolve it before analysis.' }

Look for: Match: True and three matching SHA-256 values. This supports saved file integrity between the recorded image and this copy. It cannot prove every memory page was read or that PowerShell was malicious. If a working copy already exists, hash that exact file and compare it with image-sha256.csv; record the result without silently replacing it.

2. Make the analyst's call and save your handover

Make the analyst's callThe log has been reviewed and the working copy hash matches. What can you tell the next analyst?

Every page was captured and PowerShell was malicious.The copy matches the recorded image; the PowerShell lead and capture completeness need further assessment.WinPmem found no malware, so the endpoint is clean.

Choose a finding, then use your actual capture and comparison results below.

Save this template as handover.txt in your case folder. Replace each prompt with your actual evidence, including gaps; do not claim a process was found in the image unless you analysed it.

Case SUSA-052: preserve memory for review of a reported PowerShell lead.
Authority, operator, VM identity, snapshot, installed RAM and time zone:
WinPmem release, source URL/date, executable path/hash and compatibility:
Source: live physical memory; destination disk and free-space check:
Original image path, byte size and SHA-256 record:
Exact command, start/finish UTC, exit code and console log path:
Warnings, failed attempts, retry reasons and unresolved gaps:
Working-copy path, comparison record and actual match result:
Training lead PID/time: staged benign process, not proof from the image.
Observation: what the acquisition log and saved-file checks show.
Interpretation/confidence: why these records support the handover.
Limits: capture changes the live VM and is non-atomic; hashes do not prove completeness or malicious intent.
Next check: inspect the working image's process list for the recorded training PID, then assess the reported lead with other evidence.
Closeout: retained case location and VM/evidence-disk reset plan:

Look for: a short note another analyst can use to locate the original, verify the working copy, understand capture issues and choose a next check. Your core acquisition handover is now complete; malware hunting is a separate skill.

Optional next challenge: can an analysis tool read your image?

Follow Memory analysis and the Volatility guide on a separate analysis system with a supported tool such as Volatility 3. Use the working copy to identify Windows information and list processes. Save the tool version, exact commands, output and errors in the case.

Search for the PID saved in training-lead.txt and record whether that process appears. Multiple PowerShell processes are expected; a name alone cannot identify your lead. A readable image and a matching row provide a small usability check, not proof of complete capture or malicious behaviour. If parsing fails, check image selection, OS support and symbols before concluding acquisition failed. This challenge is optional and does not change the core checkpoints.

Case closeout3. Preserve the case before restoring the VM

Preserve first

Retain the image, working copy, all attempt logs, context, hashes, lead record and handover on the evidence disk or outside the VM. Open the retained notes and check the image fingerprint before rollback.

Close the labelled training window if it is still open, then close the lab shells and shut down the disposable VM. Record closeout and restore its clean snapshot through your hypervisor. Check which disks the snapshot includes: retain the evidence disk and do not roll it back or discard it with the Windows VM. Memory images may contain sensitive data even in training; keep this case in your controlled lab storage.

Look for: a readable retained case and a recorded closeout/reset plan. Keep partial acquisitions and errors with the case. The page's Reset progress button only clears the browser ticks.

Ready for another analyst I saved the original/copy hash comparison and a handover with observations, limits and the next check. I checked the retained case and recorded the VM closeout/reset plan while preserving the evidence disk.Completion means saved evidence and an explained result. A mismatch must be resolved before calling the working copy verified; optional memory analysis is not required.

Finish with evidence another analyst can check.

Review the evidence checklist ›

Full Lab evidence checklist

Case folder handoverSave the two checkpoints in each activity.

• 1Contextcase-context.txt, tool-sha256.csv and training-lead.txt; include authority, snapshot and provenance
• 2AcquisitionOriginal RAW in memory/, every attempt's console/acquisition records in logs/, image-details.csv and image-sha256.csv
• 3HandoverRAW copy in working/, working-copy-check.csv and handover.txt; explain warnings, limitations and any unresolved checks

Your win: you preserved volatile evidence, checked its saved file integrity and gave the next analyst a clear starting point.