Dumplyzer v0.1.1

Dumplyzer v0.1.1

Follow-up to the first public Windows x64 release, focused on usability, investigation workflow improvements, and installer reliability.

What's New

• CSV export for investigation reports and IOC lists (alongside HTML, JSON, and Excel)
• Per-scan YARA selection: pick individual rules or whole categories before scanning the dump or extracted PE files
• Bundled YARA rules expanded from 42 to 56 (stealers, C2, recon)
• Pagination on large result views so those pages no longer load the full stored set at once
• Improved Domain IOC detection using the Public Suffix List and data-context analysis, reducing false hosts from filenames and path segments
• Jobs: Analyze Process shows the target PID; queued jobs no longer drag the progress percent to 0%
• Signature Detection keeps the latest scan per target and stays locked while another analysis job is running
• Clearer Carved Data antivirus warning, with the resolved data-folder path
• NSIS: if an older Dumplyzer is installed, Next uninstalls it with a progress bar (user data is kept) and then installs 0.1.1. Cancel leaves the previous install unchanged

Fixes

• IOC export file extensions
• UTF-16 custom YARA files
• Consecutive analyzed-process row highlighting
• Uninstall no longer flashes a console window

Upgrade from 0.1.0

If 0.1.0 is already installed, run Dumplyzer_0.1.1_x64-setup.exe and choose Next.

Setup removes 0.1.0 first, then installs 0.1.1. Investigation data under %LOCALAPPDATA%\Dumplyzer\ is kept.

Do not copy the new installer over an existing install.

Install

Download Dumplyzer_0.1.1_x64-setup.exe below and run it on Windows 10 22H2+ or Windows 11, x64.

Setup defaults to Program Files and requires administrator rights.

The Microsoft Edge WebView2 runtime is required. If it is missing, setup asks before downloading it from Microsoft.

This 0.1.1 installer is unsigned. SmartScreen or organization policy may warn on first run.

Install-tested on the same Windows 10/11 x64 hosts as 0.1.0.

Bundled Components

• Volatility 3 2.28.0
• CPython 3.12.10
• yara-python 4.5.4 (56 bundled Dumplyzer rules)
• CAPA 9.4.0
• FLOSS 3.1.1
• bulk_extractor 2.2.0

Notes

• The original memory image stays at its imported location. Dumplyzer does not copy it into Program Files or the user-data directory.
• Windows analysis needs the kernel PDB for that dump's OS build. Dumplyzer asks before downloading it from Microsoft (Download & Continue), or you can browse to a matching .pdb / ISF.
• YARA matches, CAPA results, and carved strings are investigation indicators, not verdicts.
• Before Carved Data jobs, consider excluding %LOCALAPPDATA%\Dumplyzer\ from real-time antivirus in controlled analysis environments. Reconstructed EXE/DLL images may be quarantined, and endpoint antivirus may also interfere with Dumplyzer while those files are being written.

Release

• Platform: Windows x64
• Installer: Dumplyzer_0.1.1_x64-setup.exe
• SHA-256: CA4D6C31225B57EF17ABD7C4F2A1AD2B5076F0C604CCDD2A08C1EDDCFF657EEF
• License: Apache-2.0 (bundled third-party components keep their own licenses)

Changelog

https://github.com/EmadAbedini/Dumplyzer/blob/v0.1.1/CHANGELOG.md

Dumplyzer v0.1.0

Dumplyzer v0.1.0

Initial public release of Dumplyzer, an open-source, local-first desktop platform for memory forensics. Analysis runs locally on the workstation. There is no cloud analysis, no account system, and no malware verdict.

Highlights

• One Windows installer: Python, the analysis engine, and supporting tools ship in the package
• Quick Triage, Complete Analysis, and Custom Analysis
• Process list, command lines, modules/DLLs, handles, parent/child tree, and per-PID deep dive
• VAD / virtual-memory regions for a selected process
• Network connections extracted from the image, plus on-demand PCAP reconstruction from recoverable Ethernet/IP records (not a full original capture)
• IOC extraction and indexed search across stored artifacts
• Investigation timeline with time-range filtering
• PE reconstruction from process memory (extracted artifacts, never executed)
• YARA scans of the dump and/or reconstructed PE files (42 bundled Dumplyzer rules, plus your own)
• CAPA capabilities and FLOSS strings on reconstructed PE files
• bulk_extractor carving (emails, URLs, IPs, and similar features)
• Plugin Explorer for supported analysis plugins, including Linux linux.* plugins
• Static HTML, JSON, and Excel exports

Bundled components

• yara-python 4.5.4
• CAPA 9.4.0
• FLOSS 3.1.1
• bulk_extractor 2.2.0

Install

Download Dumplyzer_0.1.0_x64-setup.exe below and run it on Windows 10 22H2+ or Windows 11, x64. Setup defaults to Program Files and requires administrator rights.

The Microsoft Edge WebView2 runtime is required. If it is missing, setup asks before downloading it from Microsoft.

This 0.1.0 installer is unsigned. SmartScreen or organization policy may warn on first run.

Notes

• The original memory image stays at its imported location. Dumplyzer does not copy it into Program Files or the user-data directory.
• Windows analysis needs the kernel PDB for that dump's OS build. Dumplyzer asks before downloading it from Microsoft (Download & Continue), or you can browse to a matching .pdb / ISF.
• YARA matches, CAPA results, and carved strings are investigation indicators, not verdicts.

Release

Platform: Windows x64
Installer: Dumplyzer_0.1.0_x64-setup.exe
SHA-256: 5DE5D410DDBCA0826EA5C99EE5E00664CECB70C837F33CC2410B6490C6369B66
License: Apache-2.0 (bundled third-party components keep their own licenses)

Changelog: https://github.com/EmadAbedini/Dumplyzer/blob/v0.1.0/CHANGELOG.md