volatility

Memory forensics framework (Volatility 2; Kali volatility).

$ volatility -f mem.raw imageinfo
$ volatility -f mem.raw --profile=Win7SP1x64 pslist
$ volatility -f mem.raw --profile=Win7SP1x64 netscan