GCFA Introduction to Memory Forensics — 30 Questions

Question 1

What is the primary forensic benefit of utilizing an offline memory image rather than a live response capture for a deep-dive investigation?

Accepted Answer

It provides a more stable, point-in-time snapshot. Offline memory images provide a stable, point-in-time snapshot of the system state. Unlike live response, which modifies the system's memory and environment during the capture process, an offline image is captured without active process changes. This ensures that the evidence is not altered by the collection tool itself, providing the highest level of forensic integrity for court-admissible investigations and reducing the risk of triggering anti-forensic measures within the malware.

Answer

It is faster to acquire than a live capture

Answer

It requires less storage space on the examiner's device

Answer

It allows the examiner to edit the memory content

Question 2

When examining memory, which TWO of the following are valid techniques for detecting malicious network activity that might not be visible in standard OS logs?

Accepted Answer

Parsing the kernel's network connection pool structures. Memory forensics allows an analyst to look directly at the internal structures of network sockets and endpoint states. By analyzing the pool tags associated with network structures or extracting the contents of memory-resident connection tables, one can identify hidden connections. These techniques bypass the limitations of user-mode logs that malware might suppress or clear, ensuring that covert communication channels are revealed during the investigation.

Answer

Reviewing the Event Viewer logs for socket errors

Answer

Scanning the hard drive for browser history files

Answer

Checking the system time for synchronization

Question 3

You encounter a suspicious process with an 'ExitTime' value set. What is the forensic implication of this finding?

Accepted Answer

The process is technically dead but its structure persists.. The 'ExitTime' field in an EPROCESS structure indicates when a process terminated. If a process shows an ExitTime but still appears in the process list, it may indicate a termination race condition or a rootkit attempting to hide by 'zombie' state manipulation. This matters because it reveals potential anti-forensic efforts or crash-inducing malware, helping the analyst determine if the process was intentionally killed or survived a cleanup attempt.

Answer

The process is currently active.

Answer

The memory for the process has been freed.

Answer

The process was launched at that time.

Question 4

During a memory forensics investigation of a Windows 10 system, an analyst runs the Volatility 3 windows.malfind plugin and observes a process with memory regions that are PAGE_EXECUTE_READWRITE and contain MZ headers. The analyst wants to extract the injected executable from these memory regions for further analysis. Which Volatility 3 plugin should the analyst use to dump these suspicious memory regions to disk?

Accepted Answer

windows.memmap --dump. windows.memmap --dump is used to extract memory regions from a process based on its VADs. After malfind identifies suspicious regions, the analyst can use memmap to dump those specific regions to disk for further analysis, such as reverse engineering the injected code.

Answer

windows.procdump

Answer

windows.vadinfo --dump

Answer

windows.malfind --dump

Question 5

During memory forensics of a Windows 10 system, you observe a process named 'svchost.exe' with a parent process ID (PPID) that does not match any known service host parent. You suspect process hollowing. Which Volatility 3 plugin would best help you identify the discrepancy between the process's apparent image path and its actual memory-resident executable?

Accepted Answer

windows.hollowfind. Process hollowing involves replacing the legitimate code of a process with malicious code, often leaving the original image path intact. To detect this, you need a plugin that compares the memory-resident executable with the file on disk. windows.hollowfind performs exactly that comparison, while pslist, psscan, and malfind focus on process listing, hidden process detection, and suspicious memory regions, respectively, without directly comparing the image to disk.

Answer

windows.malfind

Answer

windows.psscan

Answer

windows.pslist

Question 6

An incident responder captures a memory image from a Windows 10 workstation using WinPmem. During analysis with Volatility 3, the examiner runs the windows.pstree plugin and notices a process named svchost.exe with a PID of 3216 that has no parent process (PPID points to a non-existent PID). The examiner suspects process hiding. Which of the following is the most likely explanation for this observation?

Accepted Answer

The svchost.exe process was created by a malicious actor using PPID spoofing, where the parent PID was set to a non-existent process to evade detection.. An invalid parent PID for a process that mimics a system executable is a classic sign of PPID spoofing, a technique used by malware to blend in and evade parent-child relationship checks. Legitimate orphaned processes retain a valid PPID even after the parent exits. DKOM typically unlinks processes rather than assigning a non-existent PID. Hibernation does not produce this artifact.

Answer

The svchost.exe process was terminated, and its parent process exited before the memory capture, leaving an orphaned process entry.

Answer

The memory image was captured while the system was in a hibernated state, causing inconsistencies in the process list.

Answer

The svchost.exe process is a legitimate child of services.exe, but the PPID was altered by a rootkit using DKOM to hide the parent-child relationship.

Question 7

An analyst is examining a memory image from a Windows 10 system infected with malware. The analyst runs the Volatility 3 plugin windows.malfind and observes several memory regions with PAGE_EXECUTE_READWRITE permissions and no mapped file. To further investigate these regions, which Volatility 3 plugin should the analyst use to extract the injected code for analysis?

Accepted Answer

windows.vadinfo. The windows.vadinfo plugin provides detailed information about a process's VAD tree, including memory regions with their permissions and backing files. When malfind identifies suspicious regions, vadinfo can be used to locate the corresponding VAD nodes and dump their contents. This allows extraction of injected code for deeper analysis. Other plugins like dumpfiles, procdump, and malfind itself do not specifically extract these unbacked executable regions.

Answer

windows.procdump

Answer

windows.dumpfiles

Answer

windows.malfind

Question 8

An incident responder captures a raw memory image from a Windows 10 workstation using WinPmem while the machine is running. The image is later loaded into Volatility 3 on a Linux analysis host. The analyst needs to enumerate active network connections that were present at the time of capture. Which Volatility 3 plugin should the analyst run first to satisfy this requirement?

Accepted Answer

windows.netscan. Network artifacts in a memory image are best recovered by scanning kernel pool objects rather than relying on the live process list. The netscan plugin parses connection structures directly from the image, so it surfaces endpoints even when the owning process has already terminated. That makes it the appropriate first command for enumerating connections that existed at capture time.

Answer

windows.cmdline

Answer

windows.netstat

Answer

windows.dlllist

Question 9

During a malware investigation, an analyst loads a Windows memory image into Volatility 3 and observes that a process named svchost.exe has a parent process ID (PPID) pointing to explorer.exe, and its image path is C:\Users\Public\svchost.exe. The analyst wants to determine whether the process is a masquerading executable rather than the legitimate service host. Which artifact should the analyst examine to compare the on-disk image path recorded in the process structure with the actual executable on disk?

Accepted Answer

The process's EPROCESS ImageFileName and the file's digital signature on disk. To confirm masquerading, the analyst must tie the name recorded in the kernel process structure to the actual file on disk and verify that file's authenticity. EPROCESS.ImageFileName provides the kernel's view of the executable name, while a digital signature check on the corresponding file establishes whether it is the legitimate signed binary or a planted impostor.

Answer

The process's PEB ImagePathName and the file's $STANDARD_INFORMATION timestamps

Answer

The process's VAD tree entries and the file's alternate data streams

Answer

The process's handle table and the file's last access time

Question 10

An incident responder acquires a memory image from a compromised Windows 10 workstation using an aggressive kernel-level driver acquisition tool. Upon analyzing the image with Volatility 3, the analyst notices that several critical system processes are completely missing from the process list traversal. Which underlying mechanism best explains why these processes are absent from the standard doubly-linked list traversal?

Accepted Answer

The malware executed direct kernel object manipulation to remove the process entries from the active process doubly-linked list.. Standard process enumeration in Volatility relies on traversing the ActiveProcessLinks doubly-linked list rooted in the PsActiveProcessHead pointer. Advanced malware frequently unlinks EPROCESS structures from this list via direct kernel object manipulation to evade standard task manager visibility. Analysts must utilize kernel pool scanning plugins like pslist alternatives to recover these hidden entries.

Answer

The memory acquisition tool utilized an unprivileged user-mode API that restricted kernel visibility.

Answer

The operating system automatically paged the missing process control blocks out to the swap file during memory dumping.

Answer

Volatility 3 requires an outdated symbol table to correctly resolve the exact offsets of the Windows 10 kernel structures.

Question 11

An examiner captures a memory image from a live system while a malicious process is active. Upon analysis using Volatility, the examiner notes that the process environment block (PEB) displays a different path for the executable than the one found in the VAD tree. Which artifact is likely being manipulated?

Accepted Answer

The process structures in memory. Discrepancies between the PEB and the Virtual Address Descriptor (VAD) tree often indicate process hollowing or replacement. Malware frequently updates the PEB image path to masquerade as legitimate system services while the VAD tree reflects the actual memory mapping of the injected code. Identifying this mismatch is critical for uncovering stealthy code injection techniques that bypass simple process listing tools by hiding the true origin of the executable.

Answer

The Master File Table (MFT) entry

Answer

The Thread Environment Block (TEB)

Answer

The System Service Descriptor Table (SSDT)

Question 12

Refer to the exhibit. An examiner observes the process tree provided. Given standard Windows operating system architecture, which specific observation indicates a high probability of malicious activity?

Accepted Answer

The parent-child relationship of svchost.exe and explorer.exe. The exhibit shows explorer.exe being spawned by svchost.exe. In a standard Windows environment, explorer.exe is spawned by userinit.exe, which in turn is spawned by winlogon.exe. A service host process (svchost.exe) spawning the Windows shell is highly anomalous behavior. This pattern suggests an injection or a process replacement attack where a malicious service has hijacked the shell or launched a secondary GUI interface for persistent command and control.

Answer

The PID 1240 is assigned to svchost.exe

Answer

The existence of two svchost.exe processes

Answer

The PID of explorer.exe is higher than svchost.exe

Question 13

An analyst is preparing to acquire memory from a compromised server. Which TWO of the following factors are the most critical to consider regarding the integrity of the evidence and system stability?

Accepted Answer

The footprint of the acquisition tool in RAM. When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

Answer

The bit-depth of the monitor attached to the server

Answer

The total capacity of the hard drive

Answer

The current time zone of the server

Question 14

Which memory artifact is most useful for reconstructing the command-line arguments used to execute a suspicious program?

Accepted Answer

The Process Environment Block (PEB). Reconstructing command-line arguments is essential for understanding the specific intent of a malicious executable. The Process Environment Block (PEB) contains the command line string passed to a process at the time of its creation. By extracting this structure from memory, an analyst can reveal hidden parameters, remote IP addresses, or command flags that the malware author attempted to hide from the visual process list, providing critical context for the investigation.

Answer

The Master File Table (MFT)

Answer

The Registry Hive files

Answer

The System Service Descriptor Table (SSDT)

Question 15

When examining a memory image, why is it necessary to ensure that the profile used for the memory analysis tool matches the target operating system's specific build?

Accepted Answer

To determine the correct offsets for kernel data structures. Kernel data structures, such as the EPROCESS list or the KPCR, change in offset and size between different OS builds and service packs. If an incorrect profile is used, the analysis tool will misinterpret these structures, leading to incorrect process listing, failed memory mapping, or complete analysis failure. Using the correct profile ensures that the tool accurately maps the memory layout according to the specific kernel offsets of the target system.

Answer

To ensure the memory image is encrypted correctly

Answer

To increase the speed of the memory dumping process

Answer

To bypass the system's kernel-mode security drivers

Question 16

When analyzing memory for evidence of code injection, which THREE of the following memory regions or indicators are most significant to investigate?

Accepted Answer

Memory segments marked as PAGE_EXECUTE_READWRITE. Code injection often involves modifying existing memory segments or creating new ones with abnormal permissions. Analysts must look for areas of memory that are marked as executable but do not map to a file on disk (private memory), detect hooks in common system libraries, or identify discrepancies between memory-resident code and the original binary on disk. These indicators are classic signs that a process has been tampered with to execute malicious logic.

Answer

The presence of standard DLLs in the loading list

Answer

The thread environment block (TEB) memory region

Question 17

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Accepted Answer

The memory segment is a malicious injection. The combination of PAGE_EXECUTE_READWRITE protection and the absence of an associated file (File: None) is a classic indicator of malicious code injection. Normal applications rarely allocate memory that is simultaneously writable and executable, as this violates standard security practices like Data Execution Prevention (DEP). The lack of a file-backing suggests the code resides entirely in memory, a common technique for fileless malware to avoid detection by traditional on-disk antivirus scanners.

Answer

The memory segment is a standard heap allocation

Answer

The memory segment is a legitimate shared library

Answer

The memory segment is part of the system kernel

Question 18

When identifying a hidden process via a cross-view analysis, which memory structure is most reliable to compare against the EPROCESS list?

Accepted Answer

The thread list in the scheduler. Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Answer

The Master File Table (MFT)

Answer

The user-mode Process Environment Block (PEB)

Answer

The System Service Descriptor Table (SSDT)

Question 19

An examiner suspects that a system has been compromised with a rootkit that hooks kernel functions. Which memory forensics technique is most appropriate to detect this?

Accepted Answer

Verifying the SSDT function pointers. Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

Answer

Analyzing the process environment block (PEB)

Answer

Enumerating all running threads

Answer

Scanning for file system changes in the MFT

Question 20

Which of the following describes the purpose of the 'Object Header' in Windows memory forensics?

Accepted Answer

It contains metadata like reference counts and types. The Object Header precedes the body of every object managed by the Windows kernel, such as processes, threads, or files. It contains critical metadata, including the object type, reference count, and security descriptor. For forensic analysts, this header provides vital information about the object's lifespan and permissions, which is crucial for identifying unauthorized access or tracking the lifecycle of malicious objects within the kernel's memory management system.

Answer

It stores the process command line arguments

Answer

It is used for memory page table translations

Answer

It provides a mapping for disk-based sectors