I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, is there anyway or solution to acquire or analyze memory dynamically that including changes?
If you happen to use a tool like IDAPro, you can debug your malware and check the content of the memory and registers
- When reaching any pre-selected debug breakpoint
- Instruction per instruction
As mentionned here (https://www.hex-rays.com/products/ida/support/idadoc/1470.shtml), you can use IDAPro to take snapshots while you are in a suspended state (waiting in a breakpoint)
So basically you will dynamically see the content of the memory change after each instruction