Imagine investigating a high-stakes corporate breach where traditional antivirus and EDR tools report a completely clean bill of health. No suspicious files sit on the hard drive, no rogue executables linger in the startup registry, and the system looks pristine. Yet, forensic telemetry proves an adversary has been quietly operating inside the network for weeks.

How did they do it? They lived entirely in the volatile memory. Modern fileless malware, reflective DLL injection, and process hollowing allow sophisticated threat actors to execute arbitrary code directly inside the system's RAM, leaving zero artifacts on disk when the power cuts out. To catch these digital ghosts, incident responders must turn to memory forensics. Let’s walk through a practical, step-by-step masterclass on using Volatility 3 to unmask hidden injections.

Why RAM Never Lies: The Power of Memory Forensics

When an operating system runs, every active process, open network socket, decrypted encryption key, and loaded module lives inside physical RAM. Even if an attacker meticulously wipes their disk logs or employs advanced anti-forensic rootkits, they cannot alter the raw physical state of active memory without crashing the machine.

Capturing a complete memory dump (a .dmp or raw memory image) during an active incident provides investigators with an unalterable snapshot of everything the system was experiencing at the exact moment of acquisition. But raw memory is just a massive ocean of hex data; you need the right tools to separate signal from noise.

Step 1: Mapping Processes with pslist

Your first move in any Volatility 3 investigation is discovering what processes were running when the memory image was captured. Running the Volatility 3 process listing plugin provides a structured view of all active processes:

python vol.py -f memory.dmp windows.pslist

As an analyst, you aren't just looking for obvious malicious names. Advanced attackers love to mimic legitimate system binaries (such naming a rogue process svchost.exe or spelling it with subtle typos like scvhost.exe). Pay close attention to parent-child process relationships, process IDs (PIDs), and unexpected execution paths.

Step 2: Hunting Injections with malfind

Once you suspect anomalous behavior, the most powerful plugin in your toolkit is malfind. This module scans process virtual memory spaces for suspicious characteristics—specifically, memory regions that are marked as Read-Write-Execute (RWX) combined with executable header signatures (like the classic MZ DOS header) that don't map cleanly to a legitimate file on disk.

python vol.py -f memory.dmp windows.malfind

If malfind flags a legitimate process like explorer.exe or lsass.exe containing unbacked shellcode or hidden executable blocks, you have likely uncovered a case of **process hollowing** or reflective DLL injection. The plugin even lets you dump the suspicious memory region directly to your local workstation for further analysis in disassemblers like Ghidra or IDA Pro.

Step 3: Uncovering Hidden Artifacts with handles

Attackers often try to hide their tracks by unlinking processes from standard process lists (Direct Kernel Object Manipulation or DKOM). To cross-reference what might be hiding from pslist, analysts examine open object handles using:

python vol.py -f memory.dmp windows.handles

This command reveals files, registry keys, mutant objects, and network ports held open by processes, helping you expose hidden persistence mechanisms that basic administrative enumeration tools completely overlook.

By mastering memory acquisition and leveraging the modular power of Volatility 3, incident response teams can shine a blinding light into the darkest corners of compromised machines.

References & Further Reading

• The Volatility Foundation: Official Framework Documentation and Research
• GitHub: Volatility 3 Source Code Repository and Plugin Library
• SANS Institute: Digital Forensics and Incident Response (DFIR) Memory Analysis Guides
• MITRE ATT&CK Framework: Process Injection Techniques (T1055)
• NIST Computer Security Resource Center: Incident Response Guidelines