Lion Cipher Lab
Hunt injected code in a memory image with Volatility 3 (memory forensics, part 2)
- Digital Forensics & IR (DFIR)
- Advanced
- ~2 hours (plus download time for the memory image)
- Free · no account required
Why it matters
Part 1 taught you to list what was running. That is not the same as knowing what was executing. The technique that defeats a process list is process injection: the attacker's code runs inside a process that already exists and is already trusted — explorer.exe, svchost.exe, the print spooler — so the process list shows nothing but Windows components, the allow-list sees a signed Microsoft binary, and a disk examination finds no malicious file because the payload was never written to one. MITRE ATT&CK tracks this as T1055 with a dozen sub-techniques precisely because it is that common and that…
What you'll learn
- explaining process injection: what an attacker gains by running inside someone else's process
- reading Windows memory regions (VADs) and their protection flags
- running and interpreting windows.malware.malfind, column by column
- telling a real injected region from a JIT compiler's legitimate RWX allocation
- knowing what malfind structurally cannot detect, and what to run instead
- corroborating a finding across pslist, psscan, pstree, ldrmodules, dlllist, handles, netscan and cmdline
- dumping a suspicious memory region with --dump and handing it to YARA or Ghidra
- recording acquisition order and hashes so a finding survives scrutiny
- judgment: when memory forensics is the right move and when disk or EDR answers faster
Steps in this lab
- Process injection: why malware runs inside someone else's process
- WHEN memory forensics is the right move — and when it is the wrong one
- Get a memory image that actually contains an injection — and hash it before you touch it
- Confirm your Volatility 3 install and that the image is readable
- Baseline first: three different ways to ask 'what was running?'
- What malfind actually keys on — the mechanism, not the flag
- Run malfind and read the output column by column
- Why malfind lies to you: the JIT false positive, and how to dismiss it on sight
- What malfind structurally CANNOT see — and what to run instead
- Corroborate: never act on one plugin's output
- Dump the region — and take it to a second tool
- Build the narrative: which process, injected by whom, talking to what
- How to do it better than the naive way