Memory Forensics

Scope

What this is: Analysing RAM dumps to identify processes, network connections, injected code, and extract artifacts.

Competition relevance: Digital forensics and incident response. Volatility-based analysis. National+ complexity.

Why it matters: Memory contains runtime state: active malware, credentials, encryption keys, network connections.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (analysing volatile memory for malware and IOCs).

Competition area: Core to the digital forensics and incident response area, where you analyse compromised system memory to detect malware, process injection, and extract credentials or encryption keys.

Offline competence: Volatility 2/3 work entirely offline with pre-downloaded profiles. Use Volatility’s built-in help (volatility --info or vol.py --help). Memory analysis requires no network. Pre-download Windows profiles for Volatility if needed.

---

Competency Matrix

Level	Expectation
Regional	Run basic Volatility commands (pslist, netscan). Identify processes from memory dump.
National	Detect process injection (malfind, ldrmodules). Extract process memory. Timeline correlation.
Squad/Team Selection	Rootkit detection (psxview). Extract encryption keys. Malware configuration extraction.
International	Custom Volatility plugin development. Advanced malware analysis. Memory-only attacks.

---

Technical Content

Volatility Basics

Identify image profile:

# Volatility 2
volatility -f memory.dmp imageinfo

# Volatility 3
vol.py -f memory.dmp windows.info

Essential plugins:

# List processes
volatility -f memory.dmp --profile=Win10x64_19041 pslist
volatility -f memory.dmp --profile=Win10x64_19041 pstree

# Network connections
volatility -f memory.dmp --profile=Win10x64_19041 netscan

# Command history
volatility -f memory.dmp --profile=Win10x64_19041 cmdscan
volatility -f memory.dmp --profile=Win10x64_19041 consoles

# Loaded DLLs
volatility -f memory.dmp --profile=Win10x64_19041 dlllist -p 1234

# Dump process memory
volatility -f memory.dmp --profile=Win10x64_19041 procdump -p 1234 -D output/

Competition context: Flags may be in process memory, network connections, or command history. Run all basic plugins first.

---

Process Injection Detection

Detecting injected code:

# malfind - detects injected code segments
volatility -f memory.dmp --profile=Win10x64_19041 malfind

# Look for:
# - PAGE_EXECUTE_READWRITE protection (unusual)
# - Suspicious memory regions not backed by files
# - Executable code in unusual locations

# ldrmodules - compare loaded modules lists
volatility -f memory.dmp --profile=Win10x64_19041 ldrmodules

# Check columns: InLoad, InInit, InMem
# If False in any column, likely injection

# hollowscan - detect process hollowing
volatility -f memory.dmp --profile=Win10x64_19041 hollowscan

Extract injected code:

# Dump suspicious memory region
volatility -f memory.dmp --profile=Win10x64_19041 vaddump -p 1234 -D output/

# Analyze with strings/hex editor
strings output/1234.dmp | grep -i flag

---

Rootkit Detection

psxview (cross-view process detection):

volatility -f memory.dmp --profile=Win10x64_19041 psxview

# Compare process lists from different sources:
# - PsActiveProcessHead
# - EPROCESS pool scanning
# - PspCidTable
# - csrss.exe handle table

# If process appears in some lists but not others = ROOTKIT

SSDT hooks:

# System Service Descriptor Table hooks
volatility -f memory.dmp --profile=Win10x64_19041 ssdt

# Look for hooked syscalls (Owner != ntoskrnl.exe or win32k.sys)

Driver analysis:

# List kernel modules
volatility -f memory.dmp --profile=Win10x64_19041 modules

# Detect hidden drivers
volatility -f memory.dmp --profile=Win10x64_19041 driverscan

---

Credential Extraction

Extract passwords (mimikatz-style):

# lsadump - LSA secrets
volatility -f memory.dmp --profile=Win10x64_19041 lsadump

# hashdump - SAM hashes
volatility -f memory.dmp --profile=Win10x64_19041 hashdump

# mimikatz plugin (if available)
volatility -f memory.dmp --profile=Win10x64_19041 mimikatz

Registry extraction:

# List registry hives
volatility -f memory.dmp --profile=Win10x64_19041 hivelist

# Dump registry hive
volatility -f memory.dmp --profile=Win10x64_19041 dumpregistry -o 0xffff... -D output/

---

Competition Strategy & Marking

What gets marked:

• Malicious processes identified (PID, name, command line, parent PID)
• Network connections documented (IP, port, process, state)
• Injected code detected and extracted
• Credentials/keys recovered

Evidence and reporting requirements:

• Volatility command output (pslist, pstree, netscan) showing full process hierarchy
• Screenshot of malfind results with suspicious memory regions highlighted
• Extracted artefacts (dumped processes, strings output, extracted DLLs)
• MD5/SHA1 hashes of extracted malicious binaries
• Process timeline showing start times and relationships
• Written analysis explaining indicators of compromise (e.g., “svchost.exe running from C:\Temp is suspicious”)
• Network connection attribution (which PID owns which connection)
• Clear naming: memory_malfind_pid1234_injection.png, memory_extracted_malware_hash.txt

Time allocation:

• Profile identification: 5 minutes
• Basic analysis (ps, netscan): 15 minutes
• Injection detection: 20 minutes
• Artefact extraction: 20 minutes

Time-boxed drill suggestion: 60-minute memory forensics sprint: Given a Windows memory dump, identify the profile, run pslist/pstree/netscan, identify at least 2 suspicious processes (unusual parent, non-standard path, network connections to external IPs), run malfind to detect code injection, extract suspicious process memory, run strings on extracted memory to find flags, and document all findings with command output and written analysis.

---

False Flags / Wrong Paths

Common Traps

False positive injections Some legitimate software uses code injection (debuggers, AV). Verify before flagging.

Wrong profile Using incorrect profile gives garbage output. Verify with imageinfo.

Time-consuming deep dives Memory analysis can be endless. Focus on high-value artifacts first.

---

Practice Checklist

• Can identify memory dump profile
• Can list processes and network connections
• Can detect process injection with malfind/ldrmodules
• Can identify rootkits with psxview
• Can extract process memory
• Can dump credentials from LSA/SAM
• Can analyse command history
• Complete memory analysis in under 60 minutes

---

References

• Regional Roadmap: Digital forensics
• National Roadmap: Digital forensics
• Squad/Team Selection: Advanced Memory Forensics