Learning Malware Analysis

4.2 Listing Processes Using psscan

psscan is another Volatility plugin that lists the processes running on the system. Unlike pslist, psscan does not walk the doubly linked list of _EPROCESS objects. Instead, it scans the physical memory for the signature of the process objects. In other words, psscan uses a different approach to list the processes as compared to the pslist plugin. You might be thinking, what is the need for the psscan plugin when the pslist plugin can do the same thing? The answer lies in the technique used by psscan. Due to the approach it uses, it can detect terminated processes and also the hidden processes. An attacker can hide a process to prevent a forensic analyst from spotting the malicious process during live forensics. ...