D l l analysis.
Dynamic link libraries are specific to Microsoft and contains code that can be used by multiple programs
simultaneously.
Inspection of a processes running dlls and the version information of files and products may insist
in correlating processes so processes and information should be analyzed as they relate to the user
account.
So for this task there are the plugins mainly used, so there's actually more than three plugins in
volatility, but these are the mainly used plugins for DLL analysis here.
The first is where where info here where info dll list and get sits here.
So let's we're going to in this lecture we're going to start with the where info here the where info
plugin.
So this command lists the version information where info about portable executable files p files.
So the output of this file is usually quite lengthy and so can be run in separate terminal should be
investigated not wish to continue to scroll through the current terminal to retrieve the past plugin
command list and outputs.
So the where info is actually pretty rich, has pretty rich output and contains lots of information.
Here.
Very info and click on enter and yeah, the.
Yeah.
Don't worry, we're going to like copy this here and put it into next file text editor here so we can
analyze it more easily.
Yeah.
Much as you can see, we now it's volatility just consumed 25% of CPU here.
And yeah, this is our output.
Now we're going to.
Here.
H.
I'm sorry.
I can just.
Oh, no, we can't, can we?
Can we use.
Yeah.
No, we can't.
Yeah.
And as you can see, there is an output that we can analyze here.
So now I'm going to.
Copy the selections.
Oops actions file.
Actually in Linux we have to like use the copy.
Here.
Keyboard cruiser, hide windows.
Borders.
Help.
Here.
No, actually, we don't have we don't have the option to copy all of these files.
So now we're just gonna.
We're just gonna scroll it until the file is down and we got an information.
Or we can just decrease the font size to, like, smallest possible size.
Yeah, this is the smallest here.
And we can.
And it will took less time to copy all of this here.
Yeah.
It will.
Yeah.
We are halfway through it.
Yeah.
Ramos copied it.
Yeah.
And I will share this text files with you in the attachment sections of our lecture in.
Yeah.
Yeah, it's completely okay.
And.
Y.
What?
Yeah.
We now we're gonna.
Their info.
Or, uh, we're gonna.
We can also use the.
Now we're going to firstly use the info.
I'm going to pause the video here and copy to the text file and analyze it further.
And here in Linux I found I have to copy the all of the files.
So shift here.
And you're gonna go all the way up.
Here.
And we're gonna we're gonna zoom in out with this control plus minus button.
And in the at the top, we're gonna choose it and go down.
Here.
Yeah.
And we got all the information we need and then paste it on the text file here.
Now we have another plugin we're going to use.
It's named the.
Yeah, we can, we can just zoom reset here and.
Preferences.
Fix the font size or bigger.
Let's make it bigger.
The font size here.
Yeah.
14 is okay.
Okay.
Clear the terminal signs.
We copied our output and now we're going to use the volatility plugin named list.
This is our list here.
It's actually not like big as the previous output.
It just took like 2 or 3 minutes to copy it.
But it's worth it because I'm going to share it with you.
Okay.
Also.
Copy this.
And what's the Yeah list?
And paste it here.
So.
And this plugin lists all the running dlls at the time in memory.
So the alerts are composed of code that can be used by multiple programs simultaneously.
And yeah, this is the output.
It shows the all DLLs.
In Windows at the runtime here.
We have another plugin named gets its here.
Get gets as IDs.
So this security identifier is IDs.
A gets command has four very useful items in the order in which processes were started.
Refer to list and PS3.
So these results here, as you can see here we have s.
Now I'm going to explain one by one what this means.
And yeah, this is not the get sides.
Yeah, this is the get side is.
Output here.
Now, I'm going to also copy this.
And so I'm going to I have to share it with you guys because some of you might struggle getting these
codes here.
But if you just downloaded the same image file, you will get the same results.
So this is, this is the output of this gets, uh, security identifiers here.
Security identifier IDs.
And yeah, this is the system, the process name.
The first is the system.
For example, this is the process.
Name Winlogon.
Process Name.
And after, as you can see here, this is and this is the process IDs here (500) 536-6346
32688.
And like that here this is the process ID is this is the process names uh, as long here and this is
the interesting part here.
This is the security security identifier IDs.
And yeah, and here and this is the user who started it.
Some of it user, some of it like service.
Some of it.
Administrator Some of it.
Everyone.
So if the last number here, this is the tip here.
If the last number of the ID is in the range of 500, this indicates a user with administrator privileges.
For example, here, S1, S1 32 545 is the administrator.
Here, as you can see.
And so far we have found some very interesting certificates, including programs that were running and
users who were logged onto the machine.
Now, in the next lecture, we're going to perform the registry analysis.