Analyzing Memory Dumps With Volatility
Analyzes RAM memory dumps from compromised systems using the Volatility framework to...
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-memory-dumps-with-volatility -g -a claude-code -y- Repository
- mukul975/Anthropic-Cybersecurity-Skills35.4k
- Category
- Security
- Updated
- 2mo ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,732 tokens
- Runs scripts
- Yes, review before use
What it does
Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.
Analyzing Memory Dumps with Volatility
When to Use
- A compromised system's RAM has been captured and needs forensic analysis for malware artifacts
- Detecting fileless malware that exists only in memory without persistent disk artifacts
- Extracting encryption keys, passwords, or decrypted configuration from process memory
- Identifying process injection, DLL injection, or process hollowing in a compromised system
- Analyzing rootkit activity that hides from standard disk-based forensic tools
Do not use for disk image analysis; use Autopsy, FTK, or Sleuth Kit for disk forensics.
Prerequisites
- Volatility 3 installed (
pip install volatility3) with symbol tables for target OS - Memory dump file acquired from the target system (using WinPmem, LiME, or DumpIt)
- Knowledge of the source OS version for correct profile/symbol selection
- Sufficient disk space (memory dumps can be 4-64 GB)
- YARA rules for scanning memory for known malware signatures
- Strings utility for extracting readable strings from memory regions
Workflow
Step 1: Identify the Memory Dump Profile
Determine the operating system and version from the memory dump:
# Volatility 3: Automatic OS detection
vol3 -f memory.dmp windows.info
# List available plugins
vol3 -f memory.dmp --help
# If symbols are needed, download from:
# https://downloads.volatilityfoundation.org/volatility3/symbols/
# For Volatility 2 (legacy):
vol2 -f memory.dmp imageinfo
vol2 -f memory.dmp kdbgscan
Step 2: Enumerate Running Processes
List all processes and identify suspicious entries:
# List all processes
vol3 -f memory.dmp windows.pslist
# Process tree (parent-child relationships)
vol3 -f memory.dmp windows.pstree
# Scan for hidden/unlinked processes (rootkit detection)
vol3 -f memory.dmp windows.psscan
# Compare pslist vs psscan to find hidden processes
# Processes in psscan but not pslist are potentially hidden by rootkits
