# Quick Memory Dump Triage
> Fast initial assessment of a memory dump

**Tools:** [[tools/volatility3|volatility3]]

## Commands
```bash
# Identify OS
vol3 -f <dump> windows.info
# Process tree (spot anomalies)
vol3 -f <dump> windows.pstree
# Network connections
vol3 -f <dump> windows.netscan
# Injected code detection
vol3 -f <dump> windows.malfind
```

#recipe #volatility3