memory-forensics - Acquire and analyze memory dumps for incident response
Provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
Tags
Updated: 2026-09-23Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Acquire live system memory dumps
- Extract virtual machine memory
- Analyze processes and network connections
- Detect memory code injection
- Scan memory with YARA rules
- Extract registry and credential artifacts
Inputs
- Memory dump files
- YARA rules
- Symbol tables
Outputs
- Raw memory images
- Extracted executable files
- Analysis text outputs
- Extracted memory strings
Requirements
- Administrator or Root permissions
- Python environment
- Volatility 3 framework