GREM Memory Forensics & Runtime Analysis

Question 1

Which Volatility plugin lists running processes by walking the EPROCESS doubly-linked list in a Windows memory dump?

Accepted Answer

pslist

Answer

pstree

Answer

malfind

Answer

dlllist

Question 2

What is the primary purpose of comparing a PE image's in-memory IAT to its on-disk counterpart during malware analysis?

Accepted Answer

To detect API hooking or IAT patching by malware

Answer

To verify the file is not packed

Answer

To locate the malware's C2 configuration

Answer

To identify the compiler used to build the binary

Question 3

In Windows memory forensics, what does the VAD (Virtual Address Descriptor) tree track?

Accepted Answer

The virtual memory regions allocated to a process and their attributes

Answer

The list of kernel drivers currently loaded

Answer

Network socket connections for each process

Answer

CPU registers at the time of a crash

Question 4

During process injection analysis, what does finding a memory region marked PAGE_EXECUTE_READWRITE with no mapped file backing typically indicate?

Accepted Answer

Shellcode or injected code placed directly into memory without a corresponding disk file

Answer

A legitimate JIT-compiled region from a managed runtime

Answer

A memory-mapped file opened with write permissions

Answer

A standard heap allocation used for string buffers

Question 5

What technique does 'process hollowing' use to disguise malicious code inside a legitimate host process?

Accepted Answer

Unmapping the legitimate executable image and replacing it with malicious code in memory

Answer

Injecting a malicious DLL into a running process via LoadLibrary

Answer

Modifying the process's PEB to hide its true image path

Answer

Patching the SSDT to redirect system calls to malicious handlers

Question 6

Which Volatility plugin is specifically designed to detect injected code by identifying VAD regions that are executable, private, and contain PE headers?

Accepted Answer

malfind

Answer

cmdline

Answer

handles

Answer

vadinfo

Question 7

When examining a memory dump, which EPROCESS field can help identify a process that is masquerading under a legitimate name (e.g., 'svchost.exe') but was spawned from an unusual parent?

Accepted Answer

InheritedFromUniqueProcessId (PPID)

Answer

UniqueProcessId (PID)

Answer

ImageFileName

Answer

ActiveThreads