skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

memory-forensics

Analyze volatile memory dumps for malware and rootkits using Volatility 3.

5|Updated Jan 12, 2026
Search Tags:#timeline#malware#forensics#volatility#incident-response#RAM#memory-forensics
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill memory-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/memory-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill memory-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables analysts to analyze volatile memory dumps to detect malware, rootkits, credential theft, and memory-resident activity, accelerating investigations and response.

Core Features & Use Cases

  • Memory Image Acquisition: Guide acquisition of memory dumps using tools such as WinPMEM, Lime, DumpIt, or FTK Imager.
  • Process Analysis: Enumerate running processes, detect hidden or injected processes, and analyze process trees.
  • DLL/Module Analysis: Identify loaded modules, detect DLL injection, and identify hollowed processes.
  • Network Connection Analysis: Extract active network connections, listening ports, and socket information, and map to processes.
  • Registry Hive Extraction: Extract memory-resident registry hive data for offline analysis.
  • Credential Extraction: Locate credentials, password hashes, Kerberos tickets, and cached credentials in memory.
  • Malware and Rootkit Detection: Detect code injection, API hooks, SSDT/IDT modifications, and DKOM indicators.
  • Timeline Generation: Build memory-based timelines of process execution and system events.
  • Use Case: In a malware outbreak, rapidly identify memory-resident indicators and reconstruct the attack chain.

Quick Start

Start by loading a memory image and initializing the analysis pipeline to enumerate processes and detect suspicious activity.

Frequently Asked Questions about memory-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a RAM dump for malware and rootkits?▼

To analyze a RAM dump for malware, you enumerate running processes, detect hidden or injected modules, and check for API hooks or DKOM indicators. This Skill processes memory images to uncover rootkits and reconstruct the attack chain.

What is the best way to extract credentials and password hashes from volatile memory?▼

Extracting credentials from volatile memory involves scanning the RAM dump to locate password hashes, Kerberos tickets, and cached credentials. This Skill identifies memory-resident credential theft indicators to accelerate forensic investigations.

Does Volatility 3 work with Windows, Linux, and macOS memory images?▼

Volatility 3 works with Windows, Linux, and macOS memory images for incident response and threat hunting. This Skill uses Volatility 3 alongside Rekall and YARA rules to analyze volatile memory dumps across these platforms.

How do I extract active network connections from a memory dump?▼

Extracting active network connections from a memory dump requires scanning for listening ports, socket information, and mapping them to running processes. This Skill retrieves network data to support forensic investigations and incident response.

Can I build a timeline of process execution from a RAM dump?▼

You can build a timeline of process execution from a RAM dump by extracting system events and process activity logs. This Skill generates memory-based timelines to help reconstruct the sequence of events during a malware outbreak.

What tools do I need to acquire a memory dump before starting forensics analysis?▼

Acquiring a memory dump before forensics analysis requires tools like WinPMEM, Lime, DumpIt, or FTK Imager. This Skill guides the acquisition process to ensure you capture a valid RAM image for subsequent volatile memory analysis.

Related Skills

Explore More Education & Research Skills→
robit-manrobit-man

memory-forensics

Acquire volatile memory with LiME and WinPmem, then analyze it using Volatility 3.

Community
Advanced
tekgrunttekgrunt

forensic-analyst

Preserve evidence, reconstruct attack timelines, and generate auditable forensic reports using LimaCharlie.

Community
Advanced
Ramprasad4121Ramprasad4121
1

yara-rule-authoring

Guide YARA-X detection rule authoring for malware identification.

Community
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced