Chapter 10. Hunting Malware Using Memory Forensics

In the chapters covered so far, we looked at the concepts, tools, and techniques that are used to analyze malware using static, dynamic, and code analysis. In this chapter, you will understand another technique, called memory forensics (or Memory Analysis).

Memory forensics (or Memory Analysis) is an investigative technique which involves finding and extracting forensic artifacts from the computer's physical memory (RAM). A computer's memory stores valuable information about the runtime state of the system. Acquiring the memory and analyzing it will reveal necessary information for forensic investigation, such as which applications are running on the system, what objects (file, registry, and so on) these applications are accessing, active networks connections, loaded modules, loaded kernel drivers, and other information. For this reason, memory forensics is used in incident response and malware analysis.

During incident response,  in most...