Skip to content

Understanding Memory Analysis

Memory analysis examines process and operating system state, either from an acquired memory image or directly on a running system. Volatility analyses captured images; tools such as Moneta inspect live processes. Choose the approach that matches the evidence and record when it was captured or inspected.

What you will learn

By the end, you should be able to plan a plugin led investigation, distinguish absence from proof, and correlate memory findings with disk and network evidence.

What is memory analysis?

Core concept

Memory analysis frameworks interpret operating system structures and scan memory regions for processes, modules, handles, connections, code, and other artefacts. Results depend on capture completeness, operating system support, symbols, and plugin behaviour.

ProcessesModulesMemory regionsConnectionsHandles

Keep in mind: Not finding an artefact does not prove it never existed. It may have ended, been paged out, been overwritten, or fallen outside tool support.

01ProcessA running programme context represented by operating system structures02VADA structure describing a process virtual memory region03SymbolType information used to interpret operating system structures

Analysis views

Structure traversalFollow operating system lists and relationships
Pool or signature scanningSearch memory for possible structures and remnants
Process inspectionReview modules, regions, handles, commands, and tokens
Content extractionDump selected files, processes, or memory regions for further analysis

Why it matters

Reconstruct running state

Processes and operating system structures reveal activity not fully represented on disk.

Examine injected code

Memory regions and protection settings can expose suspicious in process content.

Network structures may connect endpoints and ports with process context.

Recover transient content

Selected files, commands, strings, or decrypted material may be extracted for review.

How memory analysis works

  1. ValidateVerify the image, capture notes, operating system context, and known acquisition limitations.
  2. BaselineIdentify system information and expected processes before looking for anomalies.
  3. TriageReview processes, parents, commands, modules, users, handles, and connections.
  4. DeepenInspect relevant memory regions, scan for hidden structures, and extract selected content.
  5. CorrelateCompare results with file system, event, Registry, identity, and network evidence.

Choose the next step

ScenarioA scan finds a process object that is absent from the normal process list. What should you do?

Move from baseline to anomaly

  1. 1ValidateKnow the capture and operating system context.
  2. 2BaselineUnderstand expected process relationships.
  3. 3InvestigateInspect regions, modules, handles, and connections.
  4. 4CorroborateSupport memory findings with other evidence.

Memory analysis tools in SUSA

Plugin led analysis

Volatility and Workbench

Examine operating system and process artefacts in memory images.

Virtual file system

MemProcFS

Explore memory derived data through a mounted file system view.

Focused threat review

Moneta

Inspect process memory for suspicious characteristics.

Continue learning