Memory Malware Analysis: Detecting Malicious Signatures In Memory By VolatilityPlugin’s

Abstract

Memory forensics is used to implement and investigate malware that is executed or stored in RAM. Whether it is static malware analysis or dynamic malware analysis,each time the malware investigator retrieves the result, it is displayed in plaintext, and the investigator begins examining each result in the plaintext and triaging the malicious request. It's a labor-intensive process, and occasionally an investigator will upload malicious files to his or her computer to be analyzed for malware. These malicious files could contain worms or have the potential to infect the investigator's computer; if that happens, the attacker will keep an eye on all future investigations and the evidence they produce. With the help of this research and algorithm, whenever a malicious DLL or request is made, the algorithm will be able to identify it and flag it. This will save the investigator a lot of time because the investigator can upload files to his or her computer without worrying about whether they will be flagged as malicious behavior. We experimented wih multiple malicious files and our algorithm shows 98% efficacy.