{
  "added_at": "2026-11-06",
  "category": "dynamic-analysis",
  "description_en": "Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis. It can find hidden modules and loose executable code, reconstruct PE headers and imports, and use a clean-hash database to skip known modules.",
  "description_zh": "Process Dump 是一款 Windows 命令行工具，可将运行中进程的代码保存到磁盘，供恶意软件分析使用。它能查找隐藏模块和独立的可执行代码，重建 PE 文件头与导入表，并通过已知文件的哈希数据库跳过常见模块。",
  "entry_url": "https://awesomerea.org/resources/process-dump/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/process-dump/",
  "evidence_url": "https://github.com/glmcdona/Process-Dump/blob/e4373c687937747bf2293dd55ca09082fe4913c1/README.md",
  "group": "tools",
  "id": "process-dump",
  "json_url": "https://awesomerea.org/resources/process-dump/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/process-dump/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/process-dump/index.md",
  "name": "Process Dump",
  "name_zh": "Process Dump 进程内存转储工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Runs on 32-bit and 64-bit Windows through the matching standalone executable; run as Administrator for best access. Release v3.0.0 is dated 2026-10-03.",
    "MIT per LICENSE."
  ],
  "requirements_zh": [
    "可在 32 位和 64 位 Windows 上运行，使用对应的独立可执行文件；以管理员身份运行可获得最佳访问权限。v3.0.0 版的日期为 2026-10-03。",
    "依 LICENSE 采用 MIT 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/glmcdona/Process-Dump",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}