1. Determine the footprint of .exe
Start procmon
Start your process
Stop your process
Stop the procmon capture
Find first instance of your process as
“Process Name”
Double click
Find size

2. Capturing Memory How Much Memory Corruption Lab 2

3. procmon

4. Filter for your process

5. Process Name

6. cmd.exe it is

7. After exe Image is Loaded

8. Check the Event Properties

9. Size
Looks like 0x59000 = 364,54410
Not bad for a simple command prompt.

10. Lab 4/16/2014 Memory Acquisition
1. Capture memory using winpmem.exe
2. Determine the memory footprint of winpmem.exe