Create memory_analysis_ransomware.md

BlackAnon22 · Aug 1, 2024 · a9d4835 · a9d4835
1 parent e961371
commit a9d4835
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/posts/blueteamlabs/memory_analysis_ransomware.md b/posts/blueteamlabs/memory_analysis_ransomware.md
@@ -0,0 +1,6 @@
+![image](https://github.com/user-attachments/assets/fb48335a-29f1-49f4-9c81-fe274a9fcf7e)
+
+
+## First Question
+
+Run “vol.py -f infected.vmem --profile=Win7SP1x86 psscan” that will list all processes. What is the name of the suspicious process?