# Memory & Malware Investigation (lab)

> An EDR behavioural alert on a finance workstation could not be attributed to any file. A full disk examination found nothing: every executable signed, correctly located, hash matching the vendor.

Canonical: https://codelivly.com/labs/memory-forensics

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 500 |
| Session length | 1 h |
| Completions | 2 |

An EDR behavioural alert on a finance workstation could not be attributed to any file. A full disk examination found nothing: every executable signed, correctly located, hash matching the vendor. That report is accurate — and the machine is compromised. Memory was captured before shutdown, and the plugin output is what you have.

## Objective

Learn to investigate code that never touched the disk. You will compare two process listings that disagree on purpose, separate executable memory that a runtime allocated legitimately from memory something wrote into a process, corroborate against the module list to prove there is no file behind it, and attribute a network connection to a process that no longer exists.

## Tasks

1. Establish what you actually have
2. Compare the two process listings
3. Read the executable-memory report properly
4. Prove there is no file behind it
5. Attribute the network activity and map it

## Related

- [All labs](https://codelivly.com/practice?type=lab)