This article explores advanced memory forensics techniques for detecting malicious activity in memory, including process timelining, high-low level analysis, walking the VAD tree, and detecting rogue processes, kernel-level rootkits, DLL hijacking, process hollowing, and sophisticated persistence mechanisms.
A working analyst’s tour of dynamic malware analysis. Static triage of the PE header in PEStudio and Detect It Easy, unpacking with x64dbg and Scylla, memory forensics with Volatility 3, VBA macro de-obfuscation with olevba, network monitoring with Wireshark, and the anti-analysis tricks (PEB checks, RDTSC timing, MAC address sniffing, sandbox-detection via mouse movement) that modern families ship by default. Case studies include WannaCry, TrickBot, and Emotet.
A working operator’s view of what an incident responder finds when they run Volatility on a memory image. The plugins that hunt your beacon (pslist, psscan, malfind, netscan, windows.cmdline), the modern tradecraft that survives them (sleep masking via Ekko/FOLIAGE, module stomping vs phantom DLL hollowing, indirect syscalls), and the 2025-2026 changes that have made some of the old tricks stop working: Credential Guard, HVCI, ETW-based command line capture.