Analyzing Memory Dumps with Volatility

When to Use

• A compromised system's RAM has been captured and needs forensic analysis for malware artifacts
• Detecting fileless malware that exists only in memory without persistent disk artifacts
• Extracting encryption keys, passwords, or decrypted configuration from process memory
• Identifying process injection, DLL injection, or process hollowing in a compromised system
• Analyzing rootkit activity that hides from standard disk-based forensic tools

Do not use for disk image analysis; use Autopsy, FTK, or Sleuth Kit for disk forensics.

Prerequisites

• Volatility 3 installed (pip install volatility3) with symbol tables for target OS
• Memory dump file acquired from the target system (using WinPmem, LiME, or DumpIt)
• Knowledge of the source OS version for correct profile/symbol selection
• Sufficient disk space (memory dumps can be 4-64 GB)
• YARA rules for scanning memory for known malware signatures
• Strings utility for extracting readable strings from memory regions

Workflow

Step 1: Identify the Memory Dump Profile

Determine the operating system and version from the memory dump:

# Volatility 3: Automatic OS detection
vol3 -f memory.dmp windows.info

# List available plugins
vol3 -f memory.dmp --help

# If symbols are needed, download from:
# https://downloads.volatilityfoundation.org/volatility3/symbols/

# For Volatility 2 (legacy):
vol2 -f memory.dmp imageinfo
vol2 -f memory.dmp kdbgscan

Step 2: Enumerate Running Processes

List all processes and identify suspicious entries:

# List all processes
vol3 -f memory.dmp windows.pslist

# Process tree (parent-child relationships)
vol3 -f memory.dmp windows.pstree

# Scan for hidden/unlinked processes (rootkit detection)
vol3 -f memory.dmp windows.psscan

# Compare pslist vs psscan to find hidden processes
# Processes in psscan but not pslist are potentially hidden by rootkits

# Check for process hollowing
vol3 -f memory.dmp windows.pslist --dump
# Then verify the dumped EXE matches the expected binary on disk

Suspicious Process Indicators:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
- svchost.exe not spawned by services.exe (wrong parent)
- csrss.exe/lsass.exe with unusual parent process
- Multiple instances of lsass.exe (should be only one)
- Processes with misspelled names (scvhost.exe, lssas.exe)
- cmd.exe or powershell.exe spawned by WINWORD.EXE or browser
- Processes running from unusual paths (%TEMP%, %APPDATA%)
- Processes with no parent (orphaned - parent terminated)

Step 3: Detect Malicious Code Injection

Scan for injected code and process hollowing:

# Detect injected code in processes (malfind)
vol3 -f memory.dmp windows.malfind

# Malfind looks for:
# - Memory regions with PAGE_EXECUTE_READWRITE protection
# - Memory regions containing PE headers (MZ/PE signature)
# - VAD (Virtual Address Descriptor) anomalies

# Dump injected memory regions for analysis
vol3 -f memory.dmp windows.malfind --dump --pid 2184

# List loaded DLLs per process
vol3 -f memory.dmp windows.dlllist --pid 2184

# Detect hollowed processes by comparing mapped image to disk
vol3 -f memory.dmp windows.hollowfind

# Scan for loaded drivers (potential rootkit drivers)
vol3 -f memory.dmp windows.driverscan

# List kernel modules
vol3 -f memory.dmp windows.modules

Step 4: Analyze Network Connections

Extract active and closed network connections:

# List all network connections (active and listening)
vol3 -f memory.dmp windows.netscan

# Output columns: Offset, Protocol, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner

# Filter for established connections to external IPs
vol3 -f memory.dmp windows.netscan | grep ESTABLISHED

# For older Windows (XP/2003):
vol3 -f memory.dmp windows.netstat

# Cross-reference PIDs with process list
# Suspicious: svchost.exe connected to external IP on non-standard port
# Suspicious: notepad.exe or calc.exe with network connections

Step 5: Extract Artifacts and Credentials

Recover sensitive data from memory:

# Dump process memory for a specific PID
vol3 -f memory.dmp windows.memmap --dump --pid 2184

# Extract command-line history
vol3 -f memory.dmp windows.cmdline

# Extract environment variables
vol3 -f memory.dmp windows.envars --pid 2184

# Registry analysis (extract Run keys for persistence)
vol3 -f memory.dmp windows.registry.printkey \

…