Learning Malware Analysis

1. Memory Forensics Steps

Whether you use memory forensics as part of the incident response or for malware analysis, the following are the general steps in memory forensics:

• Memory Acquisition: This involves acquiring (or dumping) the memory of a target machine to disk. Depending on whether you are investigating an infected system or using memory forensics as part of your malware analysis, the target machine can be a system (on your network) that you suspect to be infected, or it could be an analysis machine in your lab environment where you executed the malware sample.
• Memory Analysis: After you dump the memory to disk, this step involves analyzing the dumped memory to find and extract forensic artifacts.