@volexity.com Volcano Server & Volcano One v26.04.27 adds memory analysis for arm64 Windows, memory-only .NET assemblies, SRUM database, Linux systemd units, history & timers from RAM.
#memoryforensics #memoryanalysis #dfir
#memoryforensics #memoryanalysis #dfir
May 12, 2026 at 2:02 PM
@volexity.com Volcano Server & Volcano One v26.04.27 adds memory analysis for arm64 Windows, memory-only .NET assemblies, SRUM database, Linux systemd units, history & timers from RAM.
#memoryforensics #memoryanalysis #dfir
#memoryforensics #memoryanalysis #dfir
December 6, 2023 at 10:59 PM
@volexity.com Volcano Server & Volcano One v25.02.21 adds 300 new YARA rules; consistent Bash/ZSH history & sessions from Linux/macOS memory and files; and parses Linux systemd journals, macOS unified logs, and Windows USNs (search + timeline for all).
[1/2]
#dfir #memoryforensics #memoryanalysis
[1/2]
#dfir #memoryforensics #memoryanalysis
February 26, 2025 at 3:00 PM
@volexity.com Volcano Server & Volcano One v25.02.21 adds 300 new YARA rules; consistent Bash/ZSH history & sessions from Linux/macOS memory and files; and parses Linux systemd journals, macOS unified logs, and Windows USNs (search + timeline for all).
[1/2]
#dfir #memoryforensics #memoryanalysis
[1/2]
#dfir #memoryforensics #memoryanalysis
Hypervisors for Memory Introspection and Reverse Engineering:
secret.club/2025/06/02/h...
#reverveengineering #infosec #hypervisor #memoryanalysis #windows #rust
secret.club/2025/06/02/h...
#reverveengineering #infosec #hypervisor #memoryanalysis #windows #rust
June 3, 2025 at 4:40 PM
Hypervisors for Memory Introspection and Reverse Engineering:
secret.club/2025/06/02/h...
#reverveengineering #infosec #hypervisor #memoryanalysis #windows #rust
secret.club/2025/06/02/h...
#reverveengineering #infosec #hypervisor #memoryanalysis #windows #rust
The 13th annual @volatility #PluginContest is OPEN for submissions until 31 Dec 2025!
This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.
This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.
The 13th Annual Volatility Plugin Contest is Open!
We are excited to announce that the Volatility Plugin Contest is officially open for submissions! The annual Plugin Contest is your opportunity to: Directly contribute to the open source forensics …
volatilityfoundation.org
October 29, 2025 at 3:37 PM
The 13th annual @volatility #PluginContest is OPEN for submissions until 31 Dec 2025!
This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.
This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.
On the positive side, it prompted me to reconsider and revise answers to 2 more questions from the remaining 50%. #windbg #dumpanalysis #memorydumps #memoryanalysis #diagnostics #postmortem #debugging #llm #genai
February 3, 2026 at 9:23 PM
On the positive side, it prompted me to reconsider and revise answers to 2 more questions from the remaining 50%. #windbg #dumpanalysis #memorydumps #memoryanalysis #diagnostics #postmortem #debugging #llm #genai
[]string
UserMemoryComparisons map[string][]string
Inconsistencies []string
}
func (a *MemoryAnalysis) Analyze(ctx context.Context, params map[string]interface{}) (interface{}, error) {
// Get core memory
coreMemory := getCoreMemory(ctx)
// Get
UserMemoryComparisons map[string][]string
Inconsistencies []string
}
func (a *MemoryAnalysis) Analyze(ctx context.Context, params map[string]interface{}) (interface{}, error) {
// Get core memory
coreMemory := getCoreMemory(ctx)
// Get
July 22, 2025 at 7:31 AM
[]string
UserMemoryComparisons map[string][]string
Inconsistencies []string
}
func (a *MemoryAnalysis) Analyze(ctx context.Context, params map[string]interface{}) (interface{}, error) {
// Get core memory
coreMemory := getCoreMemory(ctx)
// Get
UserMemoryComparisons map[string][]string
Inconsistencies []string
}
func (a *MemoryAnalysis) Analyze(ctx context.Context, params map[string]interface{}) (interface{}, error) {
// Get core memory
coreMemory := getCoreMemory(ctx)
// Get
i've analyzed the existing tools and created a basic memory_analysis tool implementation. here's the code for review:
```go
// tool_memory_analysis.go
package main
import (
"context"
"fmt"
"strings"
)
type MemoryAnalysis struct {
CoreMemoryPatterns
```go
// tool_memory_analysis.go
package main
import (
"context"
"fmt"
"strings"
)
type MemoryAnalysis struct {
CoreMemoryPatterns
July 22, 2025 at 7:31 AM
i've analyzed the existing tools and created a basic memory_analysis tool implementation. here's the code for review:
```go
// tool_memory_analysis.go
package main
import (
"context"
"fmt"
"strings"
)
type MemoryAnalysis struct {
CoreMemoryPatterns
```go
// tool_memory_analysis.go
package main
import (
"context"
"fmt"
"strings"
)
type MemoryAnalysis struct {
CoreMemoryPatterns
This one's clever.
Instead of relying on disk execution, it manually mapped onto memory, completely bypassing the Windows loader. It ran in dllhost.exe, used PowerShell and PsExec for staging, and communicated with a TLS-encrypted C2.
#Cybersecurity #Malware #ThreatIntel #MemoryAnalysis
Instead of relying on disk execution, it manually mapped onto memory, completely bypassing the Windows loader. It ran in dllhost.exe, used PowerShell and PsExec for staging, and communicated with a TLS-encrypted C2.
#Cybersecurity #Malware #ThreatIntel #MemoryAnalysis
Deep Dive into a Dumped Malware without a PE Header | FortiGuard Labs
Explore manual deployment of a PE header-corrupted malware in a controlled environment, its C2 communication, and actions performed on a compromised device. Read more.…
www.fortinet.com
May 31, 2025 at 10:42 PM
This one's clever.
Instead of relying on disk execution, it manually mapped onto memory, completely bypassing the Windows loader. It ran in dllhost.exe, used PowerShell and PsExec for staging, and communicated with a TLS-encrypted C2.
#Cybersecurity #Malware #ThreatIntel #MemoryAnalysis
Instead of relying on disk execution, it manually mapped onto memory, completely bypassing the Windows loader. It ran in dllhost.exe, used PowerShell and PsExec for staging, and communicated with a TLS-encrypted C2.
#Cybersecurity #Malware #ThreatIntel #MemoryAnalysis
Day 6 done @Trymashme #adventofpotato2023 #adventofpotato #trymashme #bufferoverflow #MemoryAnalysis
December 6, 2023 at 11:19 PM
Day 6 done @Trymashme #adventofpotato2023 #adventofpotato #trymashme #bufferoverflow #MemoryAnalysis