Use the Volatility script to command ldrmodules.
|memdump||The path to memory dump the file on the system being used.|
|pid||The process ID to pass to volatility malfind command.|
|dumpdir||The path to the directory in which to save the dumped memory sections.|
|dodelete||Whether to delete the directory with the VAD dumps.|
|system||The Volatility system to run the script on.|
There are no outputs for this script.