How to Analyze Memory Dumps with Volatility 3 for Incident Response

Tools for acquiring memory from Windows (live system):

# WinPmem (recommended for most use cases: open source):
# Download: https://github.com/Velocidex/WinPmem
winpmem_mini_x64_rc2.exe -o C:\Temp\memory.raw
# Acquires physical memory to a raw image file
# Takes 5-15 minutes for a 16GB system

# Magnet RAM Capture (free, GUI):
# https://www.magnetforensics.com/resources/magnet-ram-capture/
# Download and run: point output to investigation drive

# Belkasoft RAM Capturer:
# Works even if some forensic tools are blocked by security software

# FTK Imager (Lite, free):
# File > Capture Memory → select destination

# For Velociraptor: capture memory remotely:
# Artifact: Windows.Memory.Acquisition
# Streams the memory image to the Velociraptor server without local storage

Acquire on Linux:

# Using avml (Azure VM memory acquisition):
sudo avml /tmp/memory.lime

# Using LiME kernel module:
insmod lime.ko "path=/tmp/memory.lime format=lime"

# avml is simpler: pre-compiled binary, works on most modern kernels
# Download: https://github.com/microsoft/avml

Install Volatility 3:

git clone https://github.com/volatilityfoundation/volatility3
cd volatility3
pip install -r requirements.txt
# Optional: install additional requirements for specific plugins
pip install yara-python capstone pycryptodome

# Verify:
python3 vol.py -h

Step 1: List all processes (pslist):

# List processes from the Windows kernel EPROCESS doubly-linked list:
python3 vol.py -f memory.raw windows.pslist

# Key output columns:
# PID  PPID  ImageFileName  Offset(V)  Threads  Handles  SessionId  CreateTime
# 4    0     System         0xfa80...  95       472      None       2026-05-14...
# 1234 4     svchost.exe    0xfa81...  12       200      0          2026-05-14...

# Look for:
# - svchost.exe with unexpected parent (should be services.exe PID ~700-800)
# - processes with no parent (orphaned)
# - processes named suspiciously like system processes but wrong path

Step 2: Cross-reference with psscan (find hidden processes):

# Scan memory for EPROCESS structures (finds rootkit-hidden processes):
python3 vol.py -f memory.raw windows.psscan

# Compare pslist vs psscan:
python3 vol.py -f memory.raw windows.pslist --pid-filter > pslist.txt
python3 vol.py -f memory.raw windows.psscan > psscan.txt
# Processes in psscan but NOT in pslist = hidden by rootkit

Step 3: Check process executable paths:

# Show the DLL path for each process (reveals processes running from unusual locations):
python3 vol.py -f memory.raw windows.dlllist

# Or check just the image path:
python3 vol.py -f memory.raw windows.cmdline
# Output: PID  Process  Args
# 1234  svchost.exe  C:\Windows\System32\svchost.exe -k netsvcs
# 5678  svchost.exe  C:\Temp\svchost.exe -k  ← WRONG PATH

Step 4: Detect parent-child anomalies:

# View process tree:
python3 vol.py -f memory.raw windows.pstree
# Legitimate: winlogon.exe → userinit.exe → explorer.exe
# Anomalous: explorer.exe → cmd.exe → powershell.exe → curl.exe
# Anomalous: svchost.exe → cmd.exe (svchost should not spawn cmd)

Identify injected shellcode with malfind:

# malfind scans all process memory for regions that are:
# 1. Executable (PAGE_EXECUTE_* protection)
# 2. NOT backed by a file on disk (anonymous memory region)
# 3. Contain PE headers or shellcode signatures
python3 vol.py -f memory.raw windows.malfind

# Output includes:
# PID  Process  Address      Length  Protection  Data
# 1234 explorer 0x12340000   4096    PAGE_EXECUTE_READWRITE
#   4d 5a 90 00 03 00 00 00  MZ......  ← PE header = injected DLL
# 5678 notepad  0xabcd0000   1024    PAGE_EXECUTE_READWRITE
#   fc 48 83 e4 f0 e8 cc...          ← x64 shellcode pattern

# Extract the injected region for further analysis:
python3 vol.py -f memory.raw windows.malfind --dump --pid 1234
# Creates: pid.1234.vad.0x12340000-0x12340fff.dmp

# Analyze the extracted shellcode:
file pid.1234.vad.0x12340000-0x12340fff.dmp
# If PE: run through capa, ClamAV, or Detect-It-Easy
# If shellcode: run through scdbg or run in sandbox

Hash injected regions against VirusTotal:

# Get SHA256 of each dumped VAD region:
for f in *.dmp; do
    hash=$(sha256sum "$f" | cut -d' ' -f1)
    echo "$f: $hash"
done > dumped_hashes.txt

# Submit to VT via API:
pip install vt-py
python3 -c "
import vt, sys
client = vt.Client('YOUR_VT_API_KEY')
for line in open('dumped_hashes.txt'):
    fname, sha256 = line.strip().split(': ')
    try:
        file = client.get_object(f'/files/{sha256}')
        print(f'{fname}: {file.last_analysis_stats}')
    except:
        print(f'{fname}: NOT FOUND in VT')
client.close()
"

Extract network connections at time of capture:

# Show all active network connections and listening ports:
python3 vol.py -f memory.raw windows.netstat
# Output: PID  Proto  LocalAddr:Port  ForeignAddr:Port  State  Process
# 1234  TCP   0.0.0.0:443        0.0.0.0:0          LISTEN svchost.exe
# 5678  TCP   10.0.0.100:49522   203.0.113.1:443    ESTAB  svchost.exe
# The foreign IP of an ESTABLISHED connection is often the C2 server

# Note: windows.netstat shows connections AT THE TIME OF CAPTURE
# Connections terminated before acquisition will not appear

Extract registry hives from memory:

# List registry hives loaded in memory:
python3 vol.py -f memory.raw windows.registry.hivelist
# Shows: Offset  FileFullPath
# 0xfa8...  \REGISTRY\MACHINE\SYSTEM
# 0xfb2...  \REGISTRY\MACHINE\SOFTWARE
# 0xfc1...  \REGISTRY\USER\S-1-5-21-...

# Print a specific registry key from memory:
python3 vol.py -f memory.raw windows.registry.printkey \
  --key "Software\Microsoft\Windows\CurrentVersion\Run"
# Shows persistence keys for all loaded hives

Extract cached credentials from memory (LSA secrets, hashes):

# WARNING: Only run on evidence you own, in authorized IR

# Dump NTLM hashes from SAM (similar to mimikatz sekurlsa::logonpasswords):
python3 vol.py -f memory.raw windows.hashdump
# Output: User:RID:LMHash:NTHash:::

# Extract LSA secrets:
python3 vol.py -f memory.raw windows.lsadump

# Extract cached domain credentials:
python3 vol.py -f memory.raw windows.cachedump

# These outputs are NTLM hashes: check if matches known breach databases
# or crack with hashcat -m 1000 (NTLM mode)

YARA scan the memory image:

# Scan memory with YARA rules (e.g., Mandiant's flare-rules or Neo23x0's signatures):
python3 vol.py -f memory.raw windows.vadyarascan --yara-rules malware.yar
# Or scan with a YARA rule string:
python3 vol.py -f memory.raw windows.vadyarascan \
  --yara-rule 'rule CobaltStrike { strings: $cs = {FC 48 83 E4 F0 E8 C8 00 00 00} condition: $cs }'
# Identifies specific malware families by their in-memory signatures