Skip to content

Understanding Memory Analysis

Memory analysis examines an acquired memory image to reconstruct operating-system and process state that existed close to the time of capture.

What you will learn

By the end, you should be able to plan a plugin-led investigation, distinguish absence from proof, and correlate memory findings with disk and network evidence.

What is memory analysis?

Core concept

Memory-analysis frameworks interpret operating-system structures and scan memory regions for processes, modules, handles, connections, code, and other artefacts. Results depend on capture completeness, operating-system support, symbols, and plugin behaviour.

ProcessesModulesMemory regionsConnectionsHandles

Keep in mind: Not finding an artefact does not prove it never existed. It may have ended, been paged out, been overwritten, or fallen outside tool support.

01ProcessA running programme context represented by operating-system structures02VADA structure describing a process virtual-memory region03SymbolType information used to interpret operating-system structures

Analysis views

Structure traversalFollow operating-system lists and relationships
Pool or signature scanningSearch memory for possible structures and remnants
Process inspectionReview modules, regions, handles, commands, and tokens
Content extractionDump selected files, processes, or memory regions for further analysis

Why it matters

Reconstruct running state

Processes and operating-system structures reveal activity not fully represented on disk.

Examine injected code

Memory regions and protection settings can expose suspicious in-process content.

Network structures may connect endpoints and ports with process context.

Recover transient content

Selected files, commands, strings, or decrypted material may be extracted for review.

How memory analysis works

  1. ValidateVerify the image, capture notes, operating-system context, and known acquisition limitations.
  2. BaselineIdentify system information and expected processes before looking for anomalies.
  3. TriageReview processes, parents, commands, modules, users, handles, and connections.
  4. DeepenInspect relevant memory regions, scan for hidden structures, and extract selected content.
  5. CorrelateCompare results with file-system, event, Registry, identity, and network evidence.

Choose the next step

ScenarioA scan finds a process object that is absent from the normal process list. What should you do?

Move from baseline to anomaly

  1. 1ValidateKnow the capture and operating-system context.
  2. 2BaselineUnderstand expected process relationships.
  3. 3InvestigateInspect regions, modules, handles, and connections.
  4. 4CorroborateSupport memory findings with other evidence.

Memory-analysis tools in SUSA

Plugin-led analysis

Volatility and Workbench

Examine operating-system and process artefacts in memory images.

Virtual file system

MemProcFS

Explore memory-derived data through a mounted file-system view.

Focused threat review

Moneta

Inspect process memory for suspicious characteristics.

Continue learning