Security Operations →hardMultiple ChoiceObjective-mapped

CAS-004 Security Operations Practice Question

During an incident response, a forensic analyst captures the memory of a compromised Windows system. Using Volatility, the analyst runs the 'pslist' command and sees a suspicious process 'svchost.exe' with a parent process 'explorer.exe'. Which Volatility plugin should the analyst use next to detect potential process hollowing?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

malfind

Process hollowing occurs when a legitimate process is created in a suspended state, its memory is unmapped, and malicious code is written. The 'malfind' plugin identifies processes with suspicious memory characteristics (e.g., executable memory not mapped to a file).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
netscan
Why it's wrong here
netscan shows network connections, not process hollowing.
✗
psxview
Why it's wrong here
psxview compares process listings from different sources to detect hidden processes, not hollowing.
✗
dlllist
Why it's wrong here
dlllist shows loaded DLLs; it may not directly indicate hollowing.
✓
malfind
Why this is correct
malfind detects injected code and process hollowing by scanning for executable memory.

Go deeper

CAS-004 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question