Memory analysis methodology
When examining system memory, analysts should follow a methodology. This ensures that all potential evidence is uncovered and can be utilized in an incident investigation. We will examine two methodologies. The first of these is the SANS six-part methodology. This is geared toward identifying indicators of compromise associated with the execution of malware. Another methodology focuses on leveraging an IP address or other network artifact to identify the malicious code associated with that IP address.
One of the chief aims of memory analysis is to identify potentially malicious processes or executables that can be extracted and examined. Much of the material that is present in this chapter will carry over into Chapter 16, where the extracted data will be further analyzed.
SANS six-part methodology
The SANS institution makes use of a six-part methodology for analyzing memory images. This process is designed to start from an overall view of what is...
