The Security Notebook

Memory

1 min read

Volatility Commands

  1. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f MEMORY_FILE.raw imageinfo

  2. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f MEMORY_FILE.raw —profile=PROFILE pslist

  3. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f cridex.vmem —profile=WinXPSP2x86 nethooks

  4. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f cridex.vmem —profile=WinXPSP2x86 psxview -find a process that has only one FALSE field

  5. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f cridex.vmem —profile=WinXPSP2x86 ldrmodules -InLoad, InInit, InMem. If all of these are false (besides System), that module has likely been injected which is a really bad thing.

  6. C:\Tools\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f cridex.vmem —profile=WinXPSP2x86 apihooks -If we see an instance where Hooking module: that’s really bad

Graph View