Malware and Memory Forensics

Module 1: Types of Analysis

• Swap space analysis
• Memory Analysis
• Data acquisition as per RFC 3227

Module 2: In-memory data

• Current processes
• Memory mapped files
• Caches
• Open Ports

Module 3: Memory Architectural Issues

• Data structures
• Windows Objects
• Processes
• Handles
• Pool-tag scanning
• %SystemDrive%/hiberfil.sys
• Page/Swap File

Module 4: Tools used

• Using volatility
• Dumpit.exe
• hibr2bin
• Win32dd
• Win64dd
• OSForensics

Module 5: Registry in Memory

• Understand the fundamentals of malware analysis and memory forensics.
• Learn how to identify and investigate malicious processes, files, and system activities.
• Analyze volatile memory and infected memory dumps to uncover forensic evidence.
• Detect and investigate rootkits, hidden processes, and other memory-based threats.
• Learn practical techniques for malware identification and behavioral analysis.
• Use forensic tools such as Volatility, DumpIt, and Win32dd for memory acquisition and analysis.
• Develop skills to identify indicators of compromise (IoCs) and suspicious system activity.
• Apply memory forensics techniques to support incident response and cyber investigations.
• Analyze real-world scenarios involving malware infections and compromised systems.
• Build practical skills relevant to malware analysis, digital forensics, threat intelligence, and incident response.

• Cybersecurity Professionals and Security Analysts
• Digital Forensics Investigators
• Malware Analysts
• Incident Response Professionals
• SOC Analysts
• Threat Intelligence Analysts
• Cybersecurity Consultants
• Computer Forensics Examiners
• IT and System Administrators
• Security Researchers
• IT and cybersecurity professionals looking to specialize in malware and memory forensics
• Students and aspiring cybersecurity professionals seeking practical forensic investigation skills

• Basic understanding of cybersecurity and information security concepts.
• Familiarity with Windows operating systems and system processes is recommended.
• Basic knowledge of computer networks and operating system fundamentals is beneficial.
• Understanding of common malware types and cyberattack techniques can help learners progress through the course.
• Prior experience in cybersecurity, incident response, digital forensics, or system administration is helpful but not mandatory.

• Duration: 3 hours
• Total Questions: 50
• Question Format: multiple-choice
• Labs: 1 to 2 hands-on practical scenarios