Environment
- EDR Server: 5.1.1 and Higher
Symptoms
Error message seen when trying to create a memory dump through live response:
Error getting memdump: Remote error HRESULT 0x8000ffff
Cause
If the folder is non-existent, or a file name is not being specified, the memory dump will not create.
Resolution
Specify the folder path and name of the file when running the memdump command.
Additional Notes
- When memdump command run in a directory that is known to exist on the endpoint, there will be a spinning icon acknowledging that the server has made the call and is waiting for the memory dump to be sent up. Once it is complete, the Live Response page will give a pop-up to download and save the file locally.
- Live Response can be used to create a folder in a specific directory, using the "mkdir" command.
- Memdumps cannot be created directly to a remote IP - they must be created locally on the endpoint with Live Response.
Related Content
