Learning Malware Analysis

1.3 Dumping The Process Memory Region

After you have identified the injected code (PE file or shellcode) in the process memory, you may want to dump it to disk for further analysis (for extracting strings, to perform YARA scans, or for disassembly). To dump a region of memory described by the VAD node, you can use the vaddump plugin. For example, if you want to dump the memory region containing the shellcode at address 0x03110000, you can supply the -b (--base) option followed by the base address, as follows. If you don’t specify the -b (--base) option, the plugin dumps all memory regions into separate files:

$ python vol.py -f spyeye.vmem --profile=Win7SP1x86 vaddump -p 1608 -b 0x03110000 -D dump/Volatility Foundation Volatility Framework ...