Memory Forensics & Process Anomaly Triage

Memory forensics provides real-time ground truth of active execution, decrypted payloads in RAM, injected code, and unbacked memory sections that evade disk-only forensics.

---

🏛️ Normal Windows Core Process Baseline

Understanding legitimate parentage, session IDs, and command lines is essential for spotting masquerading processes.

Process Name	Normal Parent	Session ID	Instance Count	Standard Path
System (PID 4)	None	0	1	N/A (Kernel)
smss.exe	System	0	1 (Master)	C:\Windows\System32\smss.exe
csrss.exe	smss.exe (exits)	0, 1, 2…	1 per active session	C:\Windows\System32\csrss.exe
wininit.exe	smss.exe	0	1	C:\Windows\System32\wininit.exe
services.exe	wininit.exe	0	1	C:\Windows\System32\services.exe
lsass.exe	wininit.exe	0	1	C:\Windows\System32\lsass.exe
svchost.exe	services.exe	0, 1	Multiple	C:\Windows\System32\svchost.exe -k <group>
winlogon.exe	smss.exe	1, 2…	1 per interactive session	C:\Windows\System32\winlogon.exe
explorer.exe	userinit.exe (exits)	1, 2…	1 per logged-on user	C:\Windows\explorer.exe

[!CAUTION] Common Red Flags:

• lsass.exe running with a parent other than wininit.exe.
• svchost.exe running without the -k parameter, running outside System32, or spawned by anything other than services.exe.
• Any core process running from C:\Windows\Temp\ or %APPDATA%.
• Typo-squatted names: scvhost.exe, svchosts.exe, lsas.exe, csrs.exe.

---

💉 Process Injection Signatures

Process injection involves running malicious code in the address space of another running process.

Primary Injection Techniques

1. DLL Injection: Writing the path of a malicious DLL into the target process and triggering CreateRemoteThread with LoadLibraryA.
2. Process Hollowing: Launching a legitimate process (e.g. svchost.exe) in a suspended state (CREATE_SUSPENDED), unmapping its executable section (NtUnmapViewOfSection), writing shellcode/PE, and resuming the thread.
3. Reflective DLL Loading: Loading a library into memory directly without utilizing the standard Windows loader (LoadLibrary) or touching disk.

The Tell-Tale Anomaly: PAGE_EXECUTE_READWRITE (RWX)

Memory pages allocated with both Write and Execute permissions that are unbacked by a mapped file on disk (type MEM_PRIVATE) almost always represent injected shellcode or unpacked malware.

---

🔬 Volatility 3 Command Cheat Sheet

Essential plugins for triage of acquired raw memory dumps (.raw, .dmp, .vmem).

# 1. Process Hierarchy Listing
vol -f memory.raw windows.pstree

# 2. Hunt for Injected Code and RWX Unbacked Memory Pages
vol -f memory.raw windows.malfind

# 3. Active and Closed Network Connections at Time of Dump
vol -f memory.raw windows.netscan

# 4. Dump Injected Memory Section or Suspect Process
vol -f memory.raw -o ./dump_output windows.dumpfiles --pid <PID>

# 5. Search for Open Handles to Files and Registry Keys
vol -f memory.raw windows.handles --pid <PID>

# 6. Extract Command Line Arguments from Process PEB
vol -f memory.raw windows.cmdline

# 7. Check for Hidden Threads (Thread Execution Hijacking)
vol -f memory.raw windows.threads

---

💾 Live RAM Acquisition Tools

When collecting RAM from a live endpoint, preserve volatile state:

1. WinPmem: Open-source physical memory acquisition driver (winpmem.exe -o mem.raw).
2. FTK Imager Lite: Portable GUI/CLI acquisition tool.
3. DumpIt (Comae): Fast 1-click terminal memory dumper.

[!IMPORTANT] Order of Volatility (RFC 3227): Always capture RAM first before running heavy disk scans or triage scripts that overwrite unallocated memory pages!