# Memory Analysis

<figure><img src="https://1422073608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ6mTp74lZCen0Sx5qHUb%2Fuploads%2FnkrrhoJUQ8pEyMIERdK6%2Fimage.png?alt=media&#x26;token=dc557a31-0f10-40af-a1de-f71f0115e3c9" alt=""><figcaption></figcaption></figure>

## Understanding Memory:&#x20;

###

Memory forensics methodology:&#x20;

1. Identify rouge processes
2. Analyze process objects&#x20;
3. Review network artifacts&#x20;
4. look for evidence of code injection
5. audit drivers and rootkit detection&#x20;
6. dump suspicious processes and drivers

{% embed url="<https://github.com/evild3ad/MemProcFS-Analyzer>" %}

{% embed url="<https://github.com/ufrisk/MemProcFS>" %}

{% embed url="<https://blog.onfvp.com/post/volatility-cheatsheet/>" %}
