Exploiting Advanced Volatile Memory Analysis Challenges for fun and Profit

SANS DFIR Summit 2022

Speaker: Solomon Sonya

Malware continues to advance in sophistication and prevalence. Well-engineered malware can obfuscate itself from the user, network, and even the operating system running host-based security applications. But one place malware cannot easily hide itself is within volatile computer memory (RAM). Many problems and inefficiencies exist with our current approach of conducting memory analysis: it takes too much time, is very labor intensive, and artifact extraction comes with a deluge of raw data that …

advanced analysis challenges fun memory memory analysis profit