GREM Memory Forensics & Runtime Analysis 2

Question 1

Which tool is widely used by DFIR analysts to acquire a full physical memory dump from a live Windows system?

Accepted Answer

WinPmem

Answer

Procmon

Answer

IDA Pro

Answer

Wireshark

Question 2

What does the Volatility `psscan` plugin do differently from `pslist` to help detect hidden processes?

Accepted Answer

It scans the raw memory for EPROCESS pool tags rather than following the linked list

Answer

It reads the Windows registry to enumerate process records

Answer

It queries the Windows Management Instrumentation (WMI) interface

Answer

It hooks the NtQuerySystemInformation API to enumerate processes

Question 3

During runtime dynamic analysis in a sandbox, what behavioral indicator strongly suggests a sample is performing DLL side-loading?

Accepted Answer

A legitimate signed application loading an unsigned DLL from its own working directory that is not part of the original install

Answer

A process creating a new Windows service with a random name

Answer

A process connecting to an IP address on port 443

Answer

A sample enumerating running processes via CreateToolhelp32Snapshot

Question 4

What is the purpose of analyzing the PEB (Process Environment Block) of a suspect process in memory forensics?

Accepted Answer

To retrieve the process image path, command-line arguments, and loaded module list

Answer

To examine the kernel stack for rootkit hooks

Answer

To read network configuration for the process

Answer

To list all open handles to registry keys

Question 5

Which injection technique uses Windows Atom tables to write shellcode into another process's memory without using WriteProcessMemory?

Accepted Answer

AtomBombing

Answer

Reflective DLL Injection

Answer

Process Doppelgänging

Answer

Thread Execution Hijacking

Question 6

What is a key forensic indicator of 'reflective DLL injection' compared to standard DLL injection?

Accepted Answer

The injected DLL is not registered in the PEB module list and has no corresponding file on disk

Answer

The DLL appears in the Windows Event Log with a LoadLibrary event

Answer

The DLL is signed with a revoked certificate

Answer

The target process shows an extra TCP socket opened after injection

Question 7

During memory analysis with Volatility, which command would extract the raw memory contents of a specific process address range to a file for further examination?

Accepted Answer

volshell with db() or the memdump plugin to dump the full process memory space

Answer

dlllist to export DLL sections

Answer

netscan to capture network state

Answer

hivelist to export registry hives