Malware Memory Analysis for Non-specialists: Investigating Publicly Available Memory Image for the Tigger Trojan Horse
Richard M. Carbone · 2014
Abstract : This report examines how a computer forensic investigator can effectively analyse an infected Windows memory dump. The author investigates how to perform such an analysis using Volatility and other investigative tools, including data carving utilities and anti-virus scanners.Volatility is a popular and evolving open source-based memory analysis framework upon which the authors previously proposed memory-specific methodology could be of aid to fellow novice memory analysts. The author examines how Volatility can be used to find evidence and indicators of infection. This report is the fifth in this series concerning Windows malware-based memory analysis. It examines a memory image infected with the Tigger/Syzor Trojan horse.