Malware Analysis

This chapter provides the reader with an introduction to memory analysisMemory analysis, used for malwareMalware detection, using the open-sourceOpen-source tool VolatilityVolatility. Using VolatilityVolatility rather than treating a memory dumpMemory dump as a big blob of data allows the examiner to complete a more structured analysis. This chapter demonstrates how to use VolatilityVolatility to find several key artifactsArtifact including different ways of listing processes, finding network connections, and using the module malfind that can detect suspicious instructions. Looking at memory analysisMemory analysis for use as a part of incident responseIncident response, it usually comes down to finding signs of intrusions or malicious code. It is about finding illegal behaviors in the processes loaded into memoryMemory. The aim of the chapter is to demonstrate how to accomplish that by showing the reader the basic functionality of VolatilityVolatility and RedlineRedline so that the reader can continue to learn memory analysisMemory analysis on his own.