TD Cyber Labs

Cyber LabsBY TUTORIALS DOJO

Labs Tool Trainers Learning Paths Docs

No sign-in required

BackCyber Labs / Memory Forensics Triage Simulated 0 / 100 pts

Memory Forensics Triage

Triage a memory image from an infected Windows host with Volatility 3. List processes, spot the rogue one, and follow its network connection to the C2 server.

Available tools: volatility
Target: localhost (127.0.0.1)

✓

What NtBuildLab / build number is the image? (e.g. 17763)

20 pts

Run windows.info first.

✓

Name the suspicious process (with extension)

40 pts

List processes with windows.pslist and look for a typo-squatted name.

✓

What is the C2 IP address the rogue process connects to?

40 pts

Enumerate network connections with windows.netscan.

Applications

target 127.0.0.1--:--

analyst@kali: ~ — Terminal

Congratulations!

You completed Memory Forensics Triage.

Points: 0 / 100
Tasks solved: 0 / 3