Exam 312-49v10 topic 1 question 653 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 653
Topic #: 1

Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses
Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?

A. malfind
B. pslist
C. mallist
D. malscan

Show Suggested Answer

Suggested Answer: A 🗳️

by Elb at April 23, 2024, 12:38 p.m.

Comments

Submit Cancel

044f354

3 months, 2 weeks ago

Selected Answer: A

ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 07 Page 760 "Detecting hidden files in memory using malfind plugin Running the malfind plugin helps forensic investigators detect hidden or injected files, which are generally dynamic-link library (DLL) files, in the memory. If the output from the pstree plugin indicates that a particular PID is suspicious, investigators should run the malfind plugin on that PID to determine its legitimacy." ----- If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

upvoted 1 times

...

jingu_bingo

7 months, 1 week ago

Selected Answer: A

CHFIv11 page 515: "malfind...hidden processes or injected code/DLLs..."

upvoted 2 times

...

Elb

7 months, 2 weeks ago

Selected Answer: A

The malfind plugin is used to identify hidden processes or injected code/DLLs in user mode memory

upvoted 2 times

...

Elb

8 months, 3 weeks ago

A < https://code.google.com/archive/p/volatility/wikis/CommandReferenceMal22.wiki#:~:text=The%20malfind%20command%20helps%20find,process%20using%20CreateRemoteThread%2D%3ELoadLibrary.

upvoted 1 times

...