1.2 KiB
1.2 KiB
API Reference: Analyzing Malware in Memory with Volatility 3
Overview
scripts/analyst.py consumes Volatility 3 windows.malfind JSON output and ranks memory
regions by injection signal (RWX protection, embedded MZ header, executable prologue). It
analyzes plugin output, not raw memory.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | JSON parsing |
| volatility3 | >= 2.5 | Produces the memory-plugin output this tool consumes |
External tools
| Tool | Purpose |
|---|---|
| Volatility 3 | Memory image analysis (pslist, pstree, malfind, netscan, dumpfiles) |
| WinPmem / LiME | Memory acquisition |
Core functions
rank_malfind(doc)
Parses malfind rows and scores each by injection indicators, returning a sorted candidate list with PID, process, address, and protection.
Usage
pip install volatility3
vol -f memory.raw -r json windows.malfind | python scripts/analyst.py malfind -
Sources
- Volatility 3 documentation — https://volatility3.readthedocs.io/
- The Art of Memory Forensics — concepts of injection detection (malfind/RWX)
- Volatility 3 JSON renderer output structure (project docs)