GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)
⚠ Common exam trap
The trap here is assuming that any plugin listing DLLs or handles will detect code injection, when injection often involves non-DLL memory regions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
windows.vadinfo
The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
windows.dlllist
Why it's wrong here
The windows.dlllist plugin lists loaded DLLs for a process. While it can show unexpected DLLs, it does not detect injected code that is not part of a DLL, such as shellcode or injected executable code. It is not the primary tool for detecting code injection.
- ✗
windows.ldrmodules
Why it's wrong here
The windows.ldrmodules plugin compares loaded modules across three lists (InLoad, InInit, InMem) to detect unlinked DLLs. While useful for finding hidden DLLs, it does not detect injected code that is not a DLL. It is not suitable for analyzing raw injected code regions.
- ✓
windows.vadinfo
Why this is correct
The windows.vadinfo plugin lists virtual address descriptors (VADs) for a process, showing memory regions and their protections. It helps identify unusual memory allocations, such as those with execute permissions that are not backed by a file, which are indicative of injected code. It complements malfind by providing detailed VAD information.
- ✗
windows.handles
Why it's wrong here
The windows.handles plugin lists open handles for processes, such as files, registry keys, and mutexes. It does not analyze memory regions for injected code. While handles can indicate malicious activity, they are not used to detect code injection directly.
- ✓
windows.malfind
Why this is correct
The windows.malfind plugin scans for memory regions with suspicious characteristics, such as PAGE_EXECUTE_READWRITE protection and no file backing. It then dumps these regions for further analysis. This is specifically designed to detect injected code and is a primary tool for identifying code injection in memory.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.