{"id":4834,"date":"2025-03-21T14:18:10","date_gmt":"2025-03-21T13:18:10","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=4834"},"modified":"2025-03-21T15:02:39","modified_gmt":"2025-03-21T14:02:39","slug":"analyzing-memory-dumps","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4834","title":{"rendered":"Analyzing memory (dumps)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">See also <a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=538\" data-type=\"post\" data-id=\"538\">mem\u00ado\u00adry dump<\/a> article.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Usu\u00adal&nbsp;stuff:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>grep<\/li>\n\n\n\n<li>strings<\/li>\n\n\n\n<li>hex edi\u00adtor<\/li>\n\n\n\n<li>\u2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Spe\u00adcial\u00adized software:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=2774\" data-type=\"post\" data-id=\"2774\">Volatil\u00adi\u00adty<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=4842\" data-type=\"post\" data-id=\"4842\">Mem\u00adProcFS<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Thinks to look out&nbsp;for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sys\u00adtem process with invalid par\u00adent process id. For example:&nbsp;<ul class=\"wp-block-list\">\n<li>Process sys\u00adtem with a par\u00adent id (nor\u00admal\u00adly, there is always only one instance with no par\u00adent process).<\/li>\n\n\n\n<li>Process scvhost or svch0st (there is only svchost.exe)<\/li>\n\n\n\n<li>\u2026 (see also Inci\u00addent response train\u00ading March&nbsp;2025)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>See also mem\u00ado\u00adry dump arti\u00adcle. Usu\u00adal&nbsp;stuff: Spe\u00adcial\u00adized soft\u00adware: Thinks to look out&nbsp;for:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[523],"tags":[],"class_list":["post-4834","post","type-post","status-publish","format-standard","hentry","category-forensic"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4834","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4834"}],"version-history":[{"count":6,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4834\/revisions"}],"predecessor-version":[{"id":4850,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4834\/revisions\/4850"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}