This is the discussion thread for the lesson "Memory Forensics with Volatility" (Reverse Engineering and Malware Analysis, Unit 5). Ask questions, share real-world examples, and help classmates who are stuck.
Conversation starters. Try explaining one of these in your own words:
- Acquire a memory dump from a VMware VM and from a live Windows system
- Explain why psscan detects DKOM-hidden processes that pslist misses
- Run malfind and interpret the output to identify injected code regions
