June 13, 2023, 5:36 p.m. | /u/Conscious-Pain2502

Computer Forensics www.reddit.com

After watching several lecture, I decided to get my hands on doing my first ever analysis on a memory dump sample. It was obtained online, a 2014 memory dump file. I use volatility to analyze the file.

My concern is that i arrive at a conclusion AdobeRAM and reader_s1 could be suspicious as they are immediately spawned out when explorer.exe is started.
I also suspect Explorer.exe which does not reside in system32. It is in the folder Windows\Explorer.exe.

Moreover malfind …

advice analysis computerforensics doing file memory memory analysis volatility

Social Engineer For Reverse Engineering Exploit Study

@ Independent study | Remote

Information Security Engineer, Sr. (Container Hardening)

@ Rackner | San Antonio, TX

BaaN IV Techno-functional consultant-On-Balfour

@ Marlabs | Piscataway, US

Senior Security Analyst

@ BETSOL | Bengaluru, India

Security Operations Centre Operator

@ NEXTDC | West Footscray, Australia

Senior Network and Security Research Officer

@ University of Toronto | Toronto, ON, CA