# Memory Analysis Procedures

## **Memory Analysis Procedures**

Memory analysis is a crucial technique in digital forensics and incident response, focusing on volatile data to uncover malicious activities within a system. The following outlines essential areas of focus and methods for effective memory dump analysis:

***

## **1. Identifying Malicious Processes**

**Key Indicators:**

* **Suspicious Process Names**:
  * Look for processes with random or uncommon names.
  * Malicious processes often disguise as legitimate ones (e.g., `svchost.exe`, `explorer.exe`) but operate from abnormal locations.
* **Process Relationships**:
  * **Parent-Child Analysis**:
    * Investigate unexpected parent-child relationships.
    * Example: `winword.exe` spawning `powershell.exe` suggests potential macro-based exploitation.
  * **Legitimate Process Anomalies**:
    * Example: `lsass.exe` should be spawned only by `wininit.exe`. Deviations indicate possible credential theft or process injection.

**Defense Evasion Techniques:**

* **Process Injection**: Malicious code injected into legitimate processes.
* **Process Hollowing**: Legitimate processes are hollowed out and replaced with malicious code.
* **DLL Injection**: Loading malicious DLLs into a legitimate process.

***

## **2. Identifying Malicious Network Connections**

**Key Steps:**

* **Examine Active Connections**:
  * Use tools like Volatility’s `netscan` or `connscan` to list active or recently closed network connections.
  * Look for uncommon ports (e.g., `4444`, `8081`) or protocols.
* **IP and Domain Analysis**:
  * Use threat intelligence platforms (e.g., VirusTotal, AbuseIPDB) to verify the legitimacy of IP addresses and domains.
  * **Red Flags**:
    * Newly registered domains.
    * Rarely accessed or external IPs linked to C2 servers.

**Practical Example:**

* A legitimate process such as `notepad.exe` with an outbound connection to an untrusted IP can indicate a compromised system.

***

## **3. Detecting Memory Injections**

Attackers inject malicious code into legitimate processes to avoid detection.

**Detection Methods:**

* **Virtual Address Descriptors (VADs)**:
  * Examine regions of memory with `EXECUTE_READWRITE` permissions.
  * These permissions are uncommon for legitimate processes and could indicate injected malicious code.
*   **Volatility Plugins**:

    * Use the `malfind` plugin:
      * Identifies processes with suspicious memory regions.
      * Provides hex dumps of injected code.

    **Example Output:**

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FMNdRim2TJKzHd59cKzuV%2Fimage.png?alt=media&#x26;token=5c9dcc64-9262-475e-b09d-7876bfd15f37" alt=""><figcaption></figcaption></figure>

```
Process: explorer.exe
Suspicious Memory Region: 0x7ffdf000 - 0x7fff0000
```

***

## **4. Analyzing Associated Files (DLLs and Executables)**

Processes depend on DLLs and executables for functionality.

**Steps:**

* Identify DLLs loaded by suspicious processes.
* Look for signs of **DLL hijacking** or **DLL injection**:
  * Malicious DLLs masquerading as legitimate ones.
  * Loaded from unusual directories.

**Tools:**

* Volatility’s `dlllist` or `ldrmodules` to list loaded modules and detect hidden DLLs.

***

## **5. Investigating Registry Keys**

The Windows Registry contains essential data on system and user behavior, often leveraged by malware for persistence.

**Key Locations:**

* **Startup Items**:
  * `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
    * Tracks applications configured to start at boot.
  * **Look for**: Unknown or suspicious entries.
* **User Activity**:
  * `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`
    * Reveals recently accessed files.
* **Persistence Mechanisms**:
  * Analyze entries under:
    * `HKLM\SYSTEM\CurrentControlSet\Services`
    * `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`

***

## **Key Points**

By systematically analyzing memory dumps, investigators can uncover a wealth of information regarding malicious activity, often hidden in volatile data. The critical focus areas include:

* **Malicious Processes**: Spotting suspicious names, behaviors, and parent-child relationships.
* **Network Connections**: Monitoring active and anomalous connections.
* **Memory Injections**: Detecting injected code and unexpected memory regions.
* **Associated Files**: Investigating linked DLLs and executables.
* **Registry Keys**: Tracking persistence and identifying unauthorized modifications.

These procedures form the backbone of effective memory forensics, enabling rapid incident response and deep forensic investigations.
