Memory forensics basics in Cybersecurity - Mini Project: Build & Apply

Memory Forensics Basics

📖 Scenario: You are a cybersecurity analyst investigating a suspicious computer. You want to understand the contents of the computer's memory to find clues about any malicious activity.

🎯 Goal: Build a simple step-by-step guide to collect and analyze memory data to identify running processes and suspicious artifacts.

📋 What You'll Learn

Create a list of running processes with exact names and IDs

Set a threshold for suspicious process memory usage

Filter processes exceeding the threshold

Add a summary note about the suspicious processes

💡 Why This Matters

🌍 Real World

Memory forensics helps cybersecurity analysts find hidden malware or unauthorized programs by examining what is running in a computer's memory.

💼 Career

Understanding memory forensics basics is essential for roles like incident responders, malware analysts, and digital forensic investigators.

1

Create a list of running processes

Create a list called processes containing these exact dictionaries representing running processes: {'name': 'explorer.exe', 'pid': 1234, 'memory_mb': 150}, {'name': 'notepad.exe', 'pid': 2345, 'memory_mb': 50}, {'name': 'malware.exe', 'pid': 3456, 'memory_mb': 300}, and {'name': 'svchost.exe', 'pid': 4567, 'memory_mb': 100}.

Cybersecurity

# Create the list of running processes
# Your code here

Hint

Use a list of dictionaries with keys 'name', 'pid', and 'memory_mb'.

2

Set a memory usage threshold

Create a variable called memory_threshold and set it to 100 to represent the memory usage in megabytes above which a process is considered suspicious.

Cybersecurity

processes = [
    {'name': 'explorer.exe', 'pid': 1234, 'memory_mb': 150},
    {'name': 'notepad.exe', 'pid': 2345, 'memory_mb': 50},
    {'name': 'malware.exe', 'pid': 3456, 'memory_mb': 300},
    {'name': 'svchost.exe', 'pid': 4567, 'memory_mb': 100}
]
# Set the memory usage threshold
# Your code here

Hint

Just assign the number 100 to the variable memory_threshold.

3

Filter suspicious processes

Create a list called suspicious_processes that contains only the processes from processes whose memory_mb value is greater than memory_threshold. Use a list comprehension with for process in processes and a condition.

Cybersecurity

processes = [
    {'name': 'explorer.exe', 'pid': 1234, 'memory_mb': 150},
    {'name': 'notepad.exe', 'pid': 2345, 'memory_mb': 50},
    {'name': 'malware.exe', 'pid': 3456, 'memory_mb': 300},
    {'name': 'svchost.exe', 'pid': 4567, 'memory_mb': 100}
]
memory_threshold = 100
# Filter processes with memory_mb greater than memory_threshold
# Your code here

Hint

Use a list comprehension with a condition comparing process['memory_mb'] to memory_threshold.

4

Add a summary note

Create a string variable called summary_note that says exactly: 'Found suspicious processes using more than 100 MB memory.'

Cybersecurity

processes = [
    {'name': 'explorer.exe', 'pid': 1234, 'memory_mb': 150},
    {'name': 'notepad.exe', 'pid': 2345, 'memory_mb': 50},
    {'name': 'malware.exe', 'pid': 3456, 'memory_mb': 300},
    {'name': 'svchost.exe', 'pid': 4567, 'memory_mb': 100}
]
memory_threshold = 100
suspicious_processes = [process for process in processes if process['memory_mb'] > memory_threshold]
# Add the summary note string
# Your code here

Hint

Assign the exact string to summary_note.

Practice

1. What is the main purpose of memory forensics in cybersecurity?

easy

A. To analyze a computer's memory to find hidden or running threats

B. To scan files on a hard drive for viruses

C. To encrypt data stored on a computer

D. To monitor internet traffic in real-time

Solution

1. Step 1: Understand memory forensics focus

   Memory forensics specifically looks at the contents of a computer's memory (RAM) to detect threats that may not be visible on disk.

2. Step 2: Compare with other cybersecurity tasks

   Scanning files on a hard drive or encrypting data are different tasks unrelated to memory analysis.

3. Final Answer:

   To analyze a computer's memory to find hidden or running threats -> Option A

4. Quick Check:

   Memory forensics = analyze memory for threats [OK]

Hint: Memory forensics = checking RAM for hidden threats [OK]

Common Mistakes:

• Confusing memory forensics with disk scanning
• Thinking it encrypts data
• Assuming it monitors network traffic

2. Which of the following is a commonly used tool for memory forensics?

easy

A. Wireshark

B. Volatility

C. Nmap

D. Metasploit

Solution

1. Step 1: Identify tools related to memory analysis

   Volatility is a well-known tool designed specifically for analyzing memory dumps.

2. Step 2: Differentiate other tools

   Wireshark is for network traffic analysis, Nmap for network scanning, and Metasploit for penetration testing, not memory forensics.

3. Final Answer:

   Volatility -> Option B

4. Quick Check:

   Memory forensics tool = Volatility [OK]

Hint: Volatility is the go-to memory forensics tool [OK]

Common Mistakes:

• Choosing Wireshark which is for network analysis
• Confusing Nmap with memory tools
• Selecting Metasploit which is for exploits

3. Consider a memory dump analyzed with Volatility showing a hidden process running. What does this indicate?

medium

A. The network connection is blocked

B. The memory dump is corrupted and unusable

C. The system is running normally with no threats

D. The system has a process that may be malicious and is hiding from normal views

Solution

1. Step 1: Understand hidden processes in memory

   A hidden process found in memory usually means malware or suspicious activity trying to avoid detection.

2. Step 2: Eliminate unrelated options

   Corrupted memory would cause errors, normal operation wouldn't show hidden processes, and network blocking is unrelated to memory processes.

3. Final Answer:

   The system has a process that may be malicious and is hiding from normal views -> Option D

4. Quick Check:

   Hidden process in memory = possible malware [OK]

Hint: Hidden process in memory usually means malware [OK]

Common Mistakes:

• Assuming memory dump is corrupted
• Thinking hidden process is normal
• Confusing network issues with memory analysis

4. You run a memory forensics tool but get no results for running processes. What is the most likely cause?

medium

A. The system has no running processes

B. The tool is designed only for disk analysis

C. The memory dump was not captured correctly

D. The network is disconnected

Solution

1. Step 1: Analyze why no processes appear

   If no running processes are found, the memory dump might be incomplete or corrupted.

2. Step 2: Rule out other options

   Memory forensics tools analyze RAM, not disk only; systems always have running processes; network status does not affect memory dump content.

3. Final Answer:

   The memory dump was not captured correctly -> Option C

4. Quick Check:

   No processes found = bad memory dump [OK]

Hint: No processes means bad or incomplete memory dump [OK]

Common Mistakes:

• Thinking tool only analyzes disk
• Assuming system can have zero processes
• Blaming network for memory dump issues

5. During an investigation, disk data shows no malware, but suspicious activity continues. How can memory forensics help?

hard

A. By analyzing the memory dump to find malware running only in RAM

B. By scanning the network for intrusions

C. By encrypting the disk to prevent malware

D. By deleting temporary files to remove threats

Solution

1. Step 1: Understand limitations of disk data

   Malware can run only in memory without leaving traces on disk, so disk scans may miss it.

2. Step 2: Use memory forensics to detect hidden malware

   Analyzing a memory dump can reveal running malware processes or injected code not visible on disk.

3. Final Answer:

   By analyzing the memory dump to find malware running only in RAM -> Option A

4. Quick Check:

   Memory forensics finds RAM-only malware [OK]

Hint: Memory forensics finds malware missed on disk [OK]

Common Mistakes:

• Confusing memory forensics with network scanning
• Thinking encryption removes malware
• Assuming deleting temp files removes threats