Why Memory Forensics?
When malware runs entirely in memory (fileless malware, injected payloads, unpacked code), the only artefact is the contents of RAM. Memory forensics captures and analyses a RAM dump to recover evidence that is invisible to disk-based tools.
If disk forensics is like examining a crime scene after the criminals have left, memory forensics is like freezing time mid-heist: you catch the burglars with their hands still in the safe, tools scattered on the floor, and the getaway car running outside.
Acquiring a Memory Dump
From a Virtual Machine (analysis environment)
| Hypervisor | Method | Output |
|---|---|---|
| VMware Workstation | Suspend VM | .vmem file in VM directory |
| VirtualBox | Take snapshot | .sav file |
| Both | Convert to raw | Use vmss2core or direct analysis |
From a Live System
# WinPmem (recommended — free, no driver installation required)
winpmem_mini_x64.exe memory.dmp
# DumpIt (single executable)
DumpIt.exe /O memory.dmp
Note: The act of acquiring memory modifies memory. Your acquisition tool loads into RAM, overwrites some data, and creates artefacts. This is unavoidable: document your tools and methodology.
Volatility 3 Basics
Volatility 3 automatically detects the OS profile from the memory dump. No profile specification needed (unlike Volatility 2).
# Basic syntax
vol -f memory.dmp [plugin_name]
# List available plugins
vol --info | grep windows
# Get system information
vol -f memory.dmp windows.info
Essential Plugins
pslist: Process List
Walks the PsActiveProcessHead doubly-linked list to enumerate processes:
vol -f memory.dmp windows.pslist
PID PPID ImageFileName CreateTime
4 0 System
388 4 smss.exe
540 532 csrss.exe
3412 1024 svchost.exe ← check parent PID
4201 3412 cmd.exe ← cmd spawned by svchost — suspicious
Limitation: DKOM (Direct Kernel Object Manipulation) rootkits unlink their EPROCESS structure from this list. pslist misses them.
psscan: Process Scanner
Scans physical memory for EPROCESS pool tags regardless of list linkage. Detects DKOM-hidden processes:
vol -f memory.dmp windows.psscan
If psscan shows a PID that pslist does not, that process is hidden by DKOM.
malfind: Injected Code Detector
Scans for memory regions that are:
- Executable (has Execute permission)
- Privately allocated (not mapped from a file on disk)
- Contain suspicious content (MZ header or code-like bytes)
vol -f memory.dmp windows.malfind
Example output:
PID Process Address Protection Hexdump
3412 svchost.exe 0x00340000 PAGE_EXECUTE_READWRITE
4d 5a 90 00... ← MZ header
An RWX private region containing an MZ header in svchost.exe is almost certainly a reflectively injected DLL.
Extract the injected PE:
vol -f memory.dmp windows.malfind --dump --pid 3412
dlllist: DLL List per Process
vol -f memory.dmp windows.dlllist --pid 3412
Lists all DLLs loaded into a process. A DLL present here but absent from disk (or loaded from an unusual path) indicates injection or side-loading.
netscan: Network Connections
vol -f memory.dmp windows.netscan
Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID
TCP 192.168.1.100 49201 185.220.x.x 443 ESTABLISHED 3412
Recovers both active and recently closed connections. Useful when C2 communication has stopped but the connection record is still in memory.
cmdline: Process Command Lines
vol -f memory.dmp windows.cmdline
PID Process Cmdline
4201 cmd.exe cmd.exe /c powershell -enc SQBFAFgA...
Shows the exact command line each process was launched with: critical for identifying LOLBin abuse and encoded PowerShell payloads.
Additional Useful Plugins
| Plugin | Purpose |
|---|---|
windows.handles | List open handles (files, registry, mutexes) per process |
windows.procdump | Dump process executable from memory to disk |
windows.vaddump | Dump all memory regions of a process |
windows.filescan | Find file objects in memory (cached files) |
windows.registry.printkey | Read registry keys from memory |
windows.svcscan | List Windows services including hidden ones |
Structured Analysis Workflow
1. vol windows.info → confirm OS version and profile
2. vol windows.pslist → baseline process list
3. vol windows.psscan → compare with pslist → hidden PIDs?
4. vol windows.cmdline → check command lines for suspicious args
5. vol windows.netscan → map network connections to PIDs
6. vol windows.malfind → detect injected code → dump suspects
7. vol windows.dlllist --pid X → check DLLs in suspicious processes
8. vol windows.handles --pid X → check for unusual mutex/file handles
9. Dump suspicious regions:
windows.procdump --pid X
windows.vaddump --pid X --dump-dir ./output/
10. Submit dumps to VirusTotal or analyse in IDA/Ghidra
malfind Criteria Explained
malfind flags a region as suspicious when ALL of the following are true:
- PAGE_EXECUTE or PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_WRITECOPY protection
- VAD type is private: region was created by
VirtualAlloc, not mapped from a file - Content heuristic: starts with MZ header OR passes basic disassembly check
A legitimate DLL is mapped from disk (not private). Injected code is allocated (private). This distinction is the fundamental basis for malfind''s detection logic.
Refer to REMA eBook 2026, Figure 5.8 for the Volatility analysis workflow diagram.