Digital Forensics and Incident Response

Dlldump

In the event that an analyst is able to identify a suspect process within the memory image, the plugin dlldump can be utilized to dump the contents of those DLL files to the local system. This allows the analysts to examine the contents of the DLL files as well as compare them to legitimate files to determine if they are malicious. For example, the process lsass.exe with the PID of 868 was identified as potentially malicious in several sections of this chapter. To acquire the DLL files and have them accessible to the local system, type the following:

forensics@ubuntu:~/Documents$ sudo volatility -f stuxnet.vmem --profile=WinXPSP2x86 -p 868 dlldump --dump-dir /home/  

The command produces the following output:

In this case, elevated ...