GREM Memory Forensics & Runtime Analysis 2

Question 1

Which tool is widely used by DFIR analysts to acquire a full physical memory dump from a live Windows system?

Accepted Answer

WinPmem

Answer

WinPmem is an open-source memory acquisition tool that loads a kernel driver to read physical memory and write it to a dump file.

Question 2

What does the Volatility `psscan` plugin do differently from `pslist` to help detect hidden processes?

Accepted Answer

It scans the raw memory for EPROCESS pool tags rather than following the linked list

Answer

By scanning physical memory for EPROCESS pool allocations using pool tag signatures, `psscan` can detect processes that have unlinked themselves from the active process list.

Question 3

During runtime dynamic analysis in a sandbox, what behavioral indicator strongly suggests a sample is performing DLL side-loading?

Accepted Answer

A legitimate signed application loading an unsigned DLL from its own working directory that is not part of the original install

Answer

DLL side-loading abuses Windows DLL search-order by placing a malicious DLL with the name of a legitimately-expected library alongside a signed executable.

Question 4

What is the purpose of analyzing the PEB (Process Environment Block) of a suspect process in memory forensics?

Accepted Answer

To retrieve the process image path, command-line arguments, and loaded module list

Answer

The PEB resides in user space and holds the ImageBaseAddress, command-line, environment variables, and the InMemoryOrderModuleList of loaded DLLs.

Question 5

Which injection technique uses Windows Atom tables to write shellcode into another process's memory without using WriteProcessMemory?

Accepted Answer

AtomBombing

Answer

AtomBombing stores shellcode as a global atom and uses NtQueueApcThread to cause the target process to read the atom into its own memory via GlobalGetAtomName.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Memory Forensics & Runtime Analysis 2