In p2.2_dumpit.mem, you successfully captured the “Lightning in a Bottle”—the raw physical RAM. Now, we enter the most tactical phase of Section 2: Memory Analysis. We aren’t looking at files on a disk anymore; we are looking at the operating brain of the computer.

When malware runs, it tries to hide. It uses techniques like Process Hollowing, DLL Injection, and Rootkit cloaking to disappear from the Windows Task Manager. But it cannot hide from a memory dump. If it’s running, it’s in the RAM.

1. The Analyst’s Lens: Volatility 3

The industry standard for this phase is Volatility. It doesn’t “run” the memory; it reconstructs the Operating System’s data structures (like the EPROCESS blocks) from the raw bytes to see exactly what was happening at the moment of capture.

• pslist: Displays all processes that the OS knows about by following the doubly-linked list.
• psscan: Scans for “Process Objects” in memory, finding hidden processes that have been unlinked from the OS list to hide from Task Manager.
• pstree: Shows the parent-child relationship. (Example: Why is cmd.exe a child of notepad.exe? That is a massive red flag).

2. Red Flags in the Process List

As a Forensic Operator, you are looking for anomalies.

1. Identity Theft: A process named svch0st.exe (with a zero) instead of svchost.exe.
2. Path Mismatch: lsass.exe running from C:\Users\Public\ instead of C:\Windows\System32\.
3. Orphaned Processes: A critical system process like services.exe that has no parent or a suspicious parent ID.
4. Injected Code: A process with “Read/Write/Execute” (RWX) memory permissions—this is where malware usually hides its payload.

Interactive Lab: [OPERATOR@OCSALY]# vol.py -f dump.mem windows.psscan

SITUATION: You have loaded the 16GB RAM dump. Your “Triage HUD” is scanning for unlinked process structures.

1. SCAN the memory space to find all active threads.
2. COMPARE the pslist (what the OS saw) vs. the psscan (what is actually there).
3. TERMINATE the hidden malware process before it executes a memory wipe.

3. Why Hidden Processes Exist

In the lab, pslist missed the malware because the malware unlinked itself from the OS’s circular list of processes.

When the Windows Task Manager asks the kernel “What is running?”, the kernel looks at the ActiveProcessLinks. If the malware has removed its name from that specific list, the Task Manager is blind to it. However, the malware still needs a Process Object in memory to actually execute on the CPU. psscan looks for those physical objects, making it one of the most powerful tools in your forensic arsenal.