0%

Explore Courses Defend What Matters

English 日本語
$ USD ¥ JPY
Contact Us
0
Sign In Create Account
Start Learning

Your Bag

Memory & Malware Forensics

04 Digital Forensics

Memory & Malware Forensics

Capture and analyse RAM to find what never touched the disk, then work out what a malware sample actually does.

Levels
04
Skill Range
Beginner → Expert
Track
Digital Forensics
Lifetime Access
Enroll Now Explore Courses
Memory & Malware Forensics
From 281CREDS

Modern intrusions increasingly avoid the disk entirely, which makes memory the only place the evidence exists. This course covers acquisition with tools such as WinPmem and LiME, then analysis in Volatility: listing processes including hidden ones, recovering network connections, extracting injected code, and pulling credentials and encryption keys from memory. Malware analysis begins with safe lab construction and isolation, then static triage through strings, imports, and packing detection, followed by dynamic analysis of process, file, registry, and network behaviour. You will work through fileless techniques, process injection and hollowing, and persistence mechanisms. Each exercise ends with indicators of compromise written up for a detection team.

Curriculum

Learning Path

Each level is enrolled separately. Work through them in order, or start at the level that matches your experience.

  1. Level 01

    Beginner

    281 CREDS

    Purpose

    Capture RAM to find what never touched the disk.

    Outcome

    You can acquire a usable memory image.

    What You'll Learn
    • Acquire memory with WinPmem or LiME without corrupting it.
    • Understand why memory holds evidence nothing else does.
    • Verify a memory image is usable before analysis.
  2. Level 02

    Intermediate

    414 CREDS

    Purpose

    Analyse memory in Volatility to reconstruct what was running.

    Outcome

    You can reconstruct system state from a memory image.

    What You'll Learn
    • List processes including hidden ones and recover network connections.
    • Extract injected code from a memory image.
    • Pull credentials and keys that only existed in RAM.
  3. Level 03

    Advanced

    737 CREDS

    Purpose

    Triage a malware sample and work out what it does.

    Outcome

    You can analyse a sample and describe its behaviour.

    What You'll Learn
    • Build a safe, isolated analysis lab.
    • Triage a sample statically through strings, imports, and packing.
    • Run dynamic analysis of process, file, registry, and network behaviour.
  4. Level 04

    Expert

    1,000 CREDS

    Purpose

    Handle fileless and injection techniques and hand findings to a detection team.

    Outcome

    You can analyse advanced malware and produce usable indicators.

    What You'll Learn
    • Work through process injection, hollowing, and persistence mechanisms.
    • Trace fileless techniques that leave nothing on disk.
    • Write indicators of compromise a detection team can deploy.