When Your Memory Forensics Tools Only Tell Half the Story

Memory forensics tools often flag a suspicious process but leave the analyst without the full picture. This talk walks through how to dig further when that happens, using open-source tooling in a REMnux virtual machine. The speaker introduces code injection in general terms, covering DLL injection, reflective DLL injection and process hollowing, and outlines the typical steps malware takes to write code into a running process.

The bulk of the session is three memory-image demonstrations. Two are straightforward: suspicious svchost and explorer processes are pivoted on through process listings, string dumps, YARA scans and malfind output, and an injected executable is confirmed inside a Chrome process. The third case is the harder one. Malfind points at a service host whose memory region shows no visible content, so the analyst checks later pages, finds an embedded PE header, carves the binary out of a dump with a hex editor, and matches it to a known malware family using ClamAV and string analysis.

The takeaway for practitioners is that a flagged memory region with no visible data can still matter, and that knowing how each plugin works helps fill the gaps that automated output leaves behind.