Error message seen when trying to create a memory dump through Live Response:
Error getting memdump: Remote error HRESULT 0x8000ffff
Carbon Black EDR (Response) Server: 5.1.1 and Higher
Use the full path and name of the file when running the command. See more at https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-Live-Response-Error-Getting-Memdump-Remote-Error/ta-p/68660
If the folder is non-existent, or a file name is not being specified, the memory dump will not create.