4 hours 15 minutes
Hi. Welcome back to the curse in this lab. We're going to analyze a memory Don't file with volatility on open source memory. Foreign six framework for insulin response on malware analysis
There's no way this type of information is called volatile is because it is a story in the system memory on When the computer get star enough, this information in memory disappears
for this. Love you, Lena Window Greatest insistent on our bro, sir, to unload the tool.
You listen to your secret program. Social seven seed will see where we are
and you will need us. Well, a memory don't file. It can be arrived. Remain. Or the MP file and many others. Imaginary one using tools such as D D dump it or the windows crashed Dump utility.
First, you need to log in your windows machine,
open a web browser
because we need to alert volatility from the website.
You can go there and visit the website, but accurately foundation that organ
Don't Lord it.
We're gonna load the latest version of volatility.
I'm saving our computer.
I'm gonna save is in my local this day under a folder named Temp.
No, we're goingto sleep it,
but just the X
file, the exit file
that is located in the folder,
which is executed vel.
Make sure that you have
the memory dump in the same folder. A stool? In my case, I have this file
called Memory that men
in this folder on this file is this is the one they don't go to analyze.
Now, open a common prompt window by typing cmd in the start menu.
No, you need to
changed the bus
or the location. The bath with volatilities located in my case is in the local dicks. D
But let me see the on the fast lane.
I'm going to change this location.
I have, in my fault, their name temp.
You know, we gotta start
typing belittling comments.
he must be four, which is the first command that we're gonna use.
But I think they will give you some information about the file on the list.
The same taxable agility
is this funny here?
1st 1 to
type the name off their secure able followed by F, which is the file over. Go to analyze funding.
The other comments
in my case and gonna type.
He's funny. Here
make sure that you replace memory that remains for German Marie file
And as we can see what a pretty still enough
that this image file
corresponds to a willow's ex P
In this case, this is just a profile. Our windows expensive because to Toby back three.
by taking a look,
but the most type
or so, the spark
it is too.
We are now sure that the windows
the restaurant off windows is windows expensively backs, too.
Now, to know what provides that supported by the special fertility,
you can type
dash E for command.
You will see the list with all the proof. I sw
because you can see here is the least
with all the commands
and the profile supported by dispersion of fertility.
Now see the least off processes that were running in the machine
when they must fight was generated.
We will use the command P s list
the same Texas same.
So we thought
co opium paste these over there
in the common pumped.
The only change in here is that we now we're gonna use the profile
to let politically know that we're dealing with the Windows experience a report to Martine
My sort of chains
thinks this profile
Philip Riff, Iet,
he must file
or memory files
B s least we'll give you the process name and I d a more information about the processes such as the date when you started and so on.
Because here the
the full list of processes
No, we're gonna use the
This is to analyze the purse placed in a tree. For my type,
the syntax is the same. But in this case, instead of Pierce list, we're gonna tie ps three.
I'm pressed. Enter.
You will see the same processes but were nicer view
No, we will use the common B s canto underlies the terminated processes.
He come in a case that the Mylar process was no in execution at this moment
in this case, this common couldn't find it,
but would be a scum.
We can't find it.
So instead of ps three,
we should die B s, it's come.
You can see here the least off terminated processes.
No, he coming It is that you
may want to safe these results in a text file
to save any result
toe a fire,
you can type
the normal relativity command
by the same boat. Greater town
on the name
off the text file,
In this case, I'm gonna name a result
dot t x t.
I'm first entered.
The fight is going to be saved in the same folder where the tool is located.
and we can see that there. Is there a soul doctor JST Fine.
With the result off the command,
he's in the command. P s ex view were confined here and processes which will show us a combination of both B s list MPs scan if a process isn't discount but not in P s list. It is probably a healing process,
so the syntax is the same.
But the termination in this case
will be B s X.
I'm press enter
and you will be able to see the process list in a more detailed way.
If you can see
you can check if the process is in the B s least or be scanned
are many other commands.
I know it is useful.
Command in volatility is the least which provides a least off dynamic link libraries that were associated with the process is in question
there many. Are
commands in volatility? You can try tapping the command.
Thus age to see the complete least
off comments or blue jeans.
Don't forget to check the references on supplementary material for more information,
and next morning we're going to see one of the windows for six centuries, the security identifiers.