search

DumpMe - Memory Image Forensics

What is the SHA1 hash of triage.mem (memory dump)?

$ sha1sum Triage-Memory.mem 
c95e8cc8c946f95a109ea8e47a6800de10a27abd  Triage-Memory.mem

What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)

Win7SP1x64

What was the process ID of notepad.exe?

$ volatility -f Triage-Memory.mem --profile=Win7SP1x64 pslist | grep notepad
Volatility Foundation Volatility Framework 2.6
0xfffffa80054f9060 notepad.exe            3032   1432      1       60      1      0 2019-03-22 05:32:22 UTC+0000                                 

3032

Name the child process of wscript.exe.

$ volatility -f Triage-Memory.mem --profile=Win7SP1x64 pslist
0xfffffa8005a80060 wscript.exe            5116   3952      8      312      1      1 2019-03-22 05:35:32 UTC+0000                                 
0xfffffa8005a1d9e0 UWkpjFjDzM.exe         3496   5116      5      109      1      1 2019-03-22 05:35:33 UTC+0000

UWkpjFjDzM.exe

What was the IP address of the machine at the time the RAM dump was created?

$ volatility -f Triage-Memory.mem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.6
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x13e057300        UDPv4    10.0.0.101:55736               *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b4f0        UDPv6    ::1:55735                      *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b790        UDPv6    fe80::7475:ef30:be18:7807:55734 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05d4b0        UDPv6    fe80::7475:ef30:be18:7807:1900 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05dec0        UDPv4    127.0.0.1:55737                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05e3f0        UDPv4    10.0.0.101:1900                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05eab0        UDPv6    ::1:1900                       *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000

10.0.0.101

Based on the answer regarding the infected PID, can you determine the IP of the attacker?

How many processes are associated with VCRUNTIME140.dll?

What is the md5 hash of the potential malware on the system?

What is the LM hash of Bob's account?

What memory protection constants does the VAD node at 0xfffffa800577ba10 have?

What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?

There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)

An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)

What was written in notepad.exe at the time when the memory dump was captured?

What is the short name of the file at file record 59045?

This box was exploited and is running meterpreter. What was the infected PID?

PreviousBankingTroubles - Memory Image ForensicsNextUlysses - Memory Image Forensics

Last updated