VolMalfind

Volatility script for command ldrmodules

Details

ID	`VolMalfind`
Language	javascript
From Version	5.0.0
Tags	memory forensics volatility server

README

The Volatility script for command ldrmodules.

Script Data

Name	Description
Script Type	javascript
Tags	memory, forensics, volatility, server

Inputs

Argument Name	Description
memdump	The path to memory dump the file on the system being used.
system	The system with Volatility installed to be used for the analysis.
pid	The rrocess ID to pass to Volatility as a parameter of the `ldrmodules` command.
profile	The Volatility profile to use.

Outputs

There are no outputs for this script.

Source

VolMalfind.js VolMalfind.yml

Download History Raw

var cmdline = 'malfind -p ' + args.pid;
var out = executeCommand('Volatility', {memdump:args.memdump, profile:args.profile, system: args.system, cmd:cmdline});
return out;