GCFA Introduction to Memory Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A memory region containing a PE header (MZ) that matches a known legitimate system DLL on disk.

  Why it's wrong here

  A memory region with a PE header matching a legitimate DLL on disk is likely a normal loaded module. While attackers can abuse legitimate DLLs through techniques like DLL hijacking, the mere presence of a matching PE header is not indicative of injection. Injection often involves unbacked regions or modifications to existing modules, so this characteristic alone does not suggest malicious activity.

• ✓

  A memory region with PAGE_EXECUTE_READWRITE protection that contains a MZ header but has no corresponding file path in the VAD.

  Why this is correct

  This combines multiple red flags: RWX permissions, an executable header, and no file backing. The absence of a file path in the VAD means the region is unbacked, which is highly suspicious. The MZ header indicates executable content, and RWX allows modification and execution. Together, these strongly suggest that malicious code was injected into the process's memory space, as legitimate modules are file-backed and typically not RWX.

• ✗

  A memory region with PAGE_READONLY protection that contains configuration data.

  Why it's wrong here

  PAGE_READONLY regions containing configuration data are common in legitimate processes. Such data might include strings, settings, or other non-executable content. This does not indicate code injection because the region is not executable and is read-only, meaning it cannot be used to run injected code. Analysts should focus on executable regions with suspicious permissions or content.

• ✗

  A memory region with PAGE_EXECUTE_READ protection that is backed by a signed Microsoft DLL.

  Why it's wrong here

  A PAGE_EXECUTE_READ region backed by a signed Microsoft DLL is typical for legitimate executable code. The permissions allow execution but not modification, which is standard for loaded modules. The digital signature further indicates authenticity. This is not indicative of injection; rather, it represents normal system behavior. Injection would involve deviations from this pattern, such as unbacked or writable executable regions.

• ✓

  A memory region with PAGE_EXECUTE_READWRITE protection that is not backed by a file on disk.

  Why this is correct

  PAGE_EXECUTE_READWRITE (RWX) permissions allow code execution and modification, which is unusual for legitimate code. When such a region is not backed by a file on disk, it suggests that code was injected directly into memory without a corresponding file. This combination is a strong indicator of process injection, as it violates the typical memory layout where executable code is mapped from files with read-only or execute-read permissions.