Memory Forensics 101: Catching Fileless Malware

Fileless and in-memory malware defeats disk-based tools by never writing a payload to disk. Memory forensics is how you catch it - by analyzing a capture of RAM.

Capture first, analyze second

Acquire a memory image with a tool like WinPmem/AVML before you power off (RAM is volatile). Then analyze it offline with Volatility 3 or MemProcFS.

What to look for

• Injected code - malfind surfaces executable memory regions with no backing file (classic injection / hollowing).
• Process anomalies - a process whose parent, path or command line doesn't match the real binary (e.g. a "svchost.exe" not in System32, or with the wrong parent).
• Process hollowing - a legitimate process whose in-memory image differs from its on-disk file.
• Network connections - active sockets from a process that shouldn't have them.
• Injected DLLs and hooks - unexpected modules and API hooks.

The mindset

Attackers hide from disk scanners by living in memory - so you meet them there. Pair memory analysis with EDR telemetry and the process-creation logs (Sysmon 1) to reconstruct the full story: what ran, from where, and what it touched.