Diving Deeper with Process Analysis Plugins

Now it’s time to investigate hidden or suspicious activity. You'll use advanced plugins to analyze parent-child process trees, detect hollowing, and uncover memory injections often used by malware.

Key topics:

• psscan, malfind, dlllist, handles

• Process hollowing and injection detection

• Identifying persistence mechanisms

• Spotting anomalies in execution flow