domains / families / security / analyzing-memory-dumps-with-volatility

analyzing-memory-dumps-with-volatility

separate

'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

When to use

• A compromised system's RAM has been captured and needs forensic analysis for malware artifacts
• Detecting fileless malware that exists only in memory without persistent disk artifacts
• Extracting encryption keys, passwords, or decrypted configuration from process memory
• Identifying process injection, DLL injection, or process hollowing in a compromised system
• Analyzing rootkit activity that hides from standard disk-based forensic tools

When not to use

• disk image analysis
• disk forensics

Skill page

Source