Given this memory dump, we will use Volatility to proceed. To view some basic info about the type of memdump, we do a `volatility -f memdump.raw imageinfo` to view the profile```$ volatility -f memdump.raw imageinfoVolatility Foundation Volatility Framework 2.6INFO    : volatility.debug    : Determining profile based on KDBG search...	          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)                     AS Layer2 : FileAddressSpace (/home/ideaengine007/Desktop/memdump.raw)                      PAE type : PAE                           DTB : 0x185000L                          KDBG : 0x8276fc28L          Number of Processors : 1     Image Type (Service Pack) : 1                KPCR for CPU 0 : 0x82770c00L             KUSER_SHARED_DATA : 0xffdf0000L           Image date and time : 2020-04-20 21:16:55 UTC+0000     Image local date and time : 2020-04-20 14:16:55 -0700```
Refering the cheatsheet available at https://digital-forensics.sans.org/media/volatility-memory-forensics-cheat-sheet.pdf , the `consoles` plugin is used to see the command history. 
```$ volatility --profile=Win7SP1x86 -f memdump.raw consolesVolatility Foundation Volatility Framework 2.6**************************************************ConsoleProcess: conhost.exe Pid: 3468Console: 0xc781c0 CommandHistorySize: 50HistoryBufferCount: 1 HistoryBufferMax: 4OriginalTitle: %SystemRoot%\system32\cmd.exeTitle: C:\Windows\system32\cmd.exeAttachedProcess: cmd.exe Pid: 3460 Handle: 0x5c----CommandHistory: 0x2f0448 Application: cmd.exe Flags: Allocated, ResetCommandCount: 1 LastAdded: 0 LastDisplayed: 0FirstCommand: 0 CommandCountMax: 50ProcessHandle: 0x5cCmd #0 at 0x2f4680: echo JCTF{nice_volatility_tricks_bro}----Screen 0x2d62d8 X:80 Y:300Dump:Microsoft Windows [Version 6.1.7601]                                            Copyright (c) 2009 Microsoft Corporation.  All rights reserved.                  C:\Users\JCTF>echo JCTF{nice_volatility_tricks_bro}                             JCTF{nice_volatility_tricks_bro}                                                 C:\Users\JCTF>```
Hence we find the flag as `JCTF{nice_volatility_tricks_bro}`
Apart from that, this is a nice blog detailing use of volatility [Memory Forensics](https://resources.infosecinstitute.com/memory-forensics-and-analysis-using-volatility/)