A review of the result from a variety of sources has indicated that the process of 1956 and the associated
executable reader cell that has the process either 228 suspected of containing malware.
So hands up reader as and while the data thus far is very useful, is often necessary to obtain confirmation
from external sources that the executable in question is malicious.
So this can include something as simple as checking the hash of the executable against third party sources
all the way to forwarding the executable to a malware in reversing engineering team.
So to cure the executable from the memory image, utilize the process process.
This means process and dump means dump here.
So you're going to use we're going to use the process dump plugin.
And yeah, it's actually syntax and volatility is pretty much the same as the previous dump processes,
which is the following command here.
As you can see here is the same actually.
So we're not going to choose another.
Here.
I want to see another list here.
So in this case, we're going to just list the.
Okay.
Uh, list.
List.
Yeah.
Uh, list.
As you can see.
Oops.
Why?
Oh, yeah, that's because of this.
And as you can see, the reader is 228 one, the 1956.
And yeah, it's dump it.
Dump it here.
So clear here.
We're going to use the proc TAM process stamp P or proc.
Proc dump.
Yeah.
The dumpster is the same.
The process virtual memory is same, but the process we're going to also dump the executable like the
explorer.exe.
But now in this case, we're going to just dump the reader SSL that that's the main malware, the main
executable that containing malware here.
Okay.
So in there.
Okay.
As you can see, executable 228 dot x is dumped named reader.sl.
And yeah, let's open this up here.
Desktop volatility.
Volatility.
Yeah.
Let's see what's what's in here.
Executable dump is dumped here.
And let's change the numbers.
So change the name.
Okay.
0010001.
Here.
Um, like, name it.
Read, Russell.
Reader sl.
Thump.
Okay, this is reader dump Excel file.
So.
So make sure that you don't open this file.
You don't want to, like, infect your computer with these files, but they're actually pretty like
old Malwares.
It's probably your antivirus program, Will.
Notify it.
Or, uh, probably these malwares will not work on the Windows 10 or newer versions because they are
written for the Windows XP Service Pack two.
Let's make sure, like, uh, who wants to get their PC infected?
So, as you can see, we check the folder we have.
Like, we dumped the dump.
We dumped the executable.
Uh, yeah.
We dump the Explorer dot exe and reader dump malicious.
As you can see, this is pretty big file because we dumped the whole Explorer file.
And inside this explorer, there is a little, uh, little dump here, But I just wanted to.
But we actually can also use the dump.
Uh, no, we don't want to.
We.
We want to do the.
Now.
It's okay.
Yeah, we don't have to because we already dumped the Explorer dot exe here.
So once the files have been acquired here, they can be analyzed for malware either by the incident
response team or through a separate malware analysis team.
So these files will make up a significant portion of the analysis in previous in actually in next lectures.
So in next lecture we're going to do an analysis files for further investigation investigation and Yeah.
I'm gonna in next lecture, we're going to analyze these files.
So that's it.
About this section.
This you are successfully complete this section.
Actually I'm going to day after this lecture, you're going to have a practice test which you can test
your practices.
It's going to probably have ten questions or more.
So if you like this course, make sure, like, uh, give the reviews.
And I, I it's like it will make me happy.
So thank you for watching.
And yeah, in next lecture, we're going to analyze these files or yeah, we can actually, uh, do
more acquisition process.
But in next lecture, mainly in next section, we're going to analyze these files.
So good bye.