GCFA Introduction to Memory Forensics Practice Question
During a memory forensics investigation, an analyst uses Volatility 3 to examine a Windows 10 memory image. The analyst runs the windows.malfind plugin and observes a memory region with PAGE_EXECUTE_READWRITE protection that contains a PE header and is not backed by a file on disk. The region is associated with a process named explorer.exe. Which of the following conclusions is most appropriate based on this finding?
⚠ Common exam trap
The trap here is dismissing the finding as a false positive due to legitimate JIT or memory-mapped files, ignoring that unbacked executable memory with a PE header is a hallmark of injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The memory region indicates that explorer.exe has been injected with malicious code, as it exhibits characteristics of process hollowing or reflective DLL injection.
A memory region with PAGE_EXECUTE_READWRITE protection, containing a PE header, and not backed by a file is a strong indicator of code injection. Legitimate processes rarely allocate such memory, and the presence of a PE header suggests a portable executable was loaded directly into memory. This is consistent with techniques like reflective DLL injection or process hollowing, where malicious code is executed within a trusted process to evade detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The memory region is likely a legitimate dynamically allocated buffer used by explorer.exe for temporary data storage.
Why it's wrong here
Legitimate dynamically allocated buffers rarely have both executable and writable permissions simultaneously, as this violates security best practices. Additionally, the presence of a PE header in such a region is highly unusual for temporary data. This combination strongly suggests malicious code injection rather than normal application behavior.
- ✗
The memory region is likely a memory-mapped file that was paged out and later paged back in without file backing due to a system error.
Why it's wrong here
Memory-mapped files retain a file backing even when paged out; the lack of file backing indicates the memory was allocated directly, not mapped from a file. System errors do not cause memory-mapped files to lose their backing. This explanation is not technically feasible and does not account for the executable and writable permissions.
- ✗
The memory region is a false positive because windows.malfind often flags legitimate JIT-compiled code from .NET applications.
Why it's wrong here
While JIT-compiled code can be executable and writable, it is typically backed by a file or associated with a known runtime. The presence of a PE header in unbacked memory is not typical for JIT code. windows.malfind is designed to flag suspicious regions, and this finding warrants further investigation, not dismissal as a false positive without additional context.
- ✓
The memory region indicates that explorer.exe has been injected with malicious code, as it exhibits characteristics of process hollowing or reflective DLL injection.
Why this is correct
PAGE_EXECUTE_READWRITE memory containing a PE header and not backed by a file is a classic indicator of code injection. Malware often uses techniques like reflective DLL injection or process hollowing to execute code within a legitimate process. The lack of file backing means the code was not loaded from disk, further supporting malicious injection.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.