diff --git a/src/detection/memory/memory_windows.c b/src/detection/memory/memory_windows.c
index b50e068c6..666d79727 100644
--- a/src/detection/memory/memory_windows.c
+++ b/src/detection/memory/memory_windows.c
@@ -1,19 +1,16 @@
 #include "memory.h"
 
-#include <winternl.h>
-#include <ntstatus.h>
 #include <windows.h>
 
 const char* ffDetectMemory(FFMemoryResult* ram)
 {
-    SYSTEM_INFO sysInfo;
-    GetNativeSystemInfo(&sysInfo);
-
-    SYSTEM_PERFORMANCE_INFORMATION info;
-    if (!NT_SUCCESS(NtQuerySystemInformation(SystemPerformanceInformation, &info, sizeof(info), NULL)))
-        return "NtQuerySystemInformation(SystemPerformanceInformation) failed";
-    ram->bytesUsed = (uint64_t)(info.TotalCommitLimit - info.AvailablePages) * sysInfo.dwPageSize;
-    ram->bytesTotal = (uint64_t)info.TotalCommitLimit * sysInfo.dwPageSize;
+    MEMORYSTATUSEX statex = {
+        .dwLength = sizeof(statex),
+    };
+    if (!GlobalMemoryStatusEx(&statex))
+        return "GlobalMemoryStatusEx() failed";
 
+    ram->bytesTotal = statex.ullTotalPhys;
+    ram->bytesUsed = statex.ullTotalPhys - statex.ullAvailPhys;
     return NULL;
 }
diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c
index 0855f76e4..f541f1964 100644
--- a/src/detection/swap/swap_windows.c
+++ b/src/detection/swap/swap_windows.c
@@ -1,4 +1,5 @@
 #include "swap.h"
+#include "util/mallocHelper.h"
 
 #include <winternl.h>
 #include <ntstatus.h>
@@ -9,11 +10,22 @@ const char* ffDetectSwap(FFSwapResult* swap)
     SYSTEM_INFO sysInfo;
     GetNativeSystemInfo(&sysInfo);
 
-    SYSTEM_PAGEFILE_INFORMATION info;
-    if (!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, &info, sizeof(info), NULL)))
-        return "NtQuerySystemInformation(SystemPagefileInformation) failed";
-    swap->bytesUsed = (uint64_t)info.TotalUsed * sysInfo.dwPageSize;
-    swap->bytesTotal = (uint64_t)info.CurrentSize * sysInfo.dwPageSize;
+    ULONG size = sizeof(SYSTEM_PAGEFILE_INFORMATION);
+    SYSTEM_PAGEFILE_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PAGEFILE_INFORMATION*)malloc(size);
+    while(true)
+    {
+        NTSTATUS status = NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size);
+        if(status == STATUS_INFO_LENGTH_MISMATCH)
+        {
+            if(!(pstart = (SYSTEM_PAGEFILE_INFORMATION*)realloc(pstart, size)))
+                return "realloc(pstart, size) failed";
+        }
+        else if(!NT_SUCCESS(status))
+            return "NtQuerySystemInformation(SystemPagefileInformation, size) failed";
+        break;
+    }
+    swap->bytesUsed = (uint64_t)pstart->TotalUsed * sysInfo.dwPageSize;
+    swap->bytesTotal = (uint64_t)pstart->CurrentSize * sysInfo.dwPageSize;
 
     return NULL;
 }