Skip to main content

Questions tagged [volatility]

Volatility is a memory forensics framework that provides functionality to analyse memory dumps and to extract valueable information from it.

10 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2 votes
0 answers
1k views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
Yang Yu's user avatar
  • 439
1 vote
1 answer
282 views

Examining linux memory dump with signs of compromise in yarascan

I have captured a memory dump of recent Ubuntu 22.04 kernel 6.2.0-39-generic. captured image with LiMe and analyzed with volatility3. did a yarascan against all known rules and found a suspicious ...
Zzgooloo's user avatar
1 vote
0 answers
208 views

Get file from the linux_volshell from volatility

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (...
P00's user avatar
  • 43
1 vote
1 answer
6k views

How to identify hidden processes with volatility using psxview?

I was learning volatility and in this room in tryhackme they used psxview to find the hidden processes. The assignment was, It's fairly common for malware to attempt to hide itself and the process ...
randomSapien's user avatar
1 vote
0 answers
484 views

Finding NonPagedPool Start and End Address using volatility

I am exploiting bluekeep vulnerability in windows server 2008 R2 using metasploit framework. When I run the exploit windows/rdp/cve_2019_0708_bluekeep_rce, it ends in BSOD on server and then server ...
aneela's user avatar
  • 201
1 vote
0 answers
3k views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
synthesis's user avatar
  • 155
1 vote
0 answers
190 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
ayesha's user avatar
  • 11
0 votes
1 answer
3k views

Volatility: AutoMagic Symbol Table error

I am trying to analyze the .vmem file from HoneyNet challenge 3: Banking Troubles (HoneyNet) using volatility3. But I can't seem to get past this error: PS C:\Users\<user>\Desktop\HoneyNet\...
Varghese George's user avatar
0 votes
1 answer
1k views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
user148614's user avatar
0 votes
0 answers
1k views

Volatility: Dumping memory associated with a particular process

I'm trying figure out how I can dump the memory associated with a process. So far, I've managed to identify the PID's of the processes I'm interested in (along with their offset). However, I can't ...
F_Infinity2's user avatar