Find malware and incident clues in memory dumps.
What it does
Guides memory-dump analysis to uncover malware, suspicious processes, and evidence for incident investigations.
When to use it
Use during incident response, breach investigations, or malware analysis involving RAM captures.
How to use it
Give it a memory capture to investigate; it produces local analysis files and extracts suspicious executables.
What you provide
- Your files
Uses
VO
Latest review
What you need · 1
FLOSS enables the additional extraction of obfuscated strings from executables or process-memory dumps.
Access · 2
This skill
downloads.volatilityfoundation.org
Read
Downloads Windows symbol tables
volatility3
Execute
Installs Volatility 3