1
2
3
4
5 import os
6
7 from lib.cuckoo.common.abstracts import Processing
8 from lib.cuckoo.common.objects import File
9 from lib.cuckoo.common.constants import CUCKOO_ROOT
10
12 """Analyze process memory dumps."""
13
15 """Run analysis.
16 @return: structured results.
17 """
18 self.key = "procmemory"
19 results = []
20
21 if os.path.exists(self.pmemory_path):
22 for dmp in os.listdir(self.pmemory_path):
23 dmp_path = os.path.join(self.pmemory_path, dmp)
24 dmp_file = File(dmp_path)
25
26 proc = dict(
27 file=dmp_path,
28 pid=os.path.splitext(os.path.basename(dmp_path))[0],
29 yara=dmp_file.get_yara(os.path.join(CUCKOO_ROOT, "data", "yara", "index_memory.yar"))
30 )
31
32 results.append(proc)
33
34 return results
35