GREM Memory Forensics & Runtime Analysis

Question 1

Which Volatility plugin lists running processes by walking the EPROCESS doubly-linked list in a Windows memory dump?

Accepted Answer

pslist

Answer

The `pslist` plugin enumerates processes by traversing the PsActiveProcessHead doubly-linked list of EPROCESS structures.

Question 2

What is the primary purpose of comparing a PE image's in-memory IAT to its on-disk counterpart during malware analysis?

Accepted Answer

To detect API hooking or IAT patching by malware

Answer

Discrepancies between the on-disk and in-memory IAT entries reveal API hooks or patches installed by malware to intercept function calls.

Question 3

In Windows memory forensics, what does the VAD (Virtual Address Descriptor) tree track?

Accepted Answer

The virtual memory regions allocated to a process and their attributes

Answer

The VAD tree is a kernel data structure maintained per-process that describes each virtual memory region, including its size, permissions, and backing file.

Question 4

During process injection analysis, what does finding a memory region marked PAGE_EXECUTE_READWRITE with no mapped file backing typically indicate?

Accepted Answer

Shellcode or injected code placed directly into memory without a corresponding disk file

Answer

RWX memory regions with no file-backed mapping are a strong indicator of shellcode or reflectively-loaded code injected into a process.

Question 5

What technique does 'process hollowing' use to disguise malicious code inside a legitimate host process?

Accepted Answer

Unmapping the legitimate executable image and replacing it with malicious code in memory

Answer

Process hollowing creates a suspended legitimate process, unmaps its image, writes malicious code into the same address space, and resumes execution.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Memory Forensics & Runtime Analysis