GCFA Memory Forensics & Volatile Data Analysis 3

Question 1

Which Windows artifact stored in memory can reveal recently accessed network shares and mapped drives during a forensic investigation?

Accepted Answer

The NetBIOS cache and SMB session structures in memory

Answer

Active SMB sessions and the NetBIOS name cache reside in memory and can expose network share connections that may not appear in log files.

Question 2

What does the Volatility 'netscan' plugin enumerate from a Windows memory image?

Accepted Answer

Active and recently closed network connections, listening ports, and associated processes

Answer

Netscan scans memory for TCP/UDP endpoint and connection structures, revealing current network activity and recently closed connections along with the owning process.

Question 3

During a memory analysis, an analyst finds a process named 'svchost.exe' with no parent process traceable to services.exe. What does this suggest?

Accepted Answer

Possible malware masquerading as svchost.exe, since legitimate instances are always spawned by services.exe

Answer

Legitimate svchost.exe instances are always children of services.exe; an orphaned or mis-parented svchost.exe is a strong indicator of malware impersonating a Windows system process.

Question 4

What is the purpose of the Volatility 'dlllist' plugin in a forensic investigation?

Accepted Answer

Enumerates DLLs loaded into each process's address space from the PEB's InMemoryOrderModuleList

Answer

Dlllist reads the PEB's loader data to enumerate all DLLs mapped into a process, helping identify malicious or unexpected modules loaded into legitimate processes.

Question 5

An analyst extracts a suspicious memory region using Volatility's 'malfind' and finds an MZ header followed by a PE structure. What is the recommended next forensic step?

Accepted Answer

Dump the PE from memory and submit it to a sandbox or perform static/dynamic malware analysis

Answer

Dumping the in-memory PE and analyzing it in a controlled environment (sandbox or static analysis) allows the analyst to understand malware capabilities without further risk.

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA Memory Forensics & Volatile Data Analysis 3