Which Volatility Plugin Identifies Hidden Processes and Injected DLLs?
Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests which Volatility plugin exposes hidden or injected user-mode memory artifacts, and the trap is choosing pslist, which only enumerates processes from the active list.
Volatility's malfind plugin scans a RAM dump for hidden processes and injected code or DLLs, making it the correct tool for this memory-forensics scenario. The page explains why pslist, mallist and malscan do not satisfy the requirement.
Many candidates pick pslist because it is the best-known process-listing plugin, but it walks the active process linked list and will not reveal unlinked hidden processes or injected code/DLL regions.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Volatility's malfind plugin is purpose-built for memory forensics: it scans process memory for executable regions that contain PE headers or other suspicious artifacts, which often indicate hidden processes, injected code or injected DLLs. In a RAM dump from a compromised victim, this plugin helps the investigator pivot from a suspicious PID identified by process-listing plugins into the memory region that contains the injected payload. The CHFI material cited by jingu_bingo directly pairs malfind with detecting "hidden processes or injected code/DLLs," and Elb adds that the plugin works on "injected code/DLLs in user mode memory." That is exactly the requirement in the question stem, so option A is the defensible choice.Why the Other Options Are Wrong
pslist walks the active process doubly-linked list and prints running processes, so it is useful baseline triage but does not by itself expose hidden or unlinked processes and does not identify injected code/DLL regions. mallist and malscan are not standard Volatility plugins for this purpose; they are plausible-sounding distractors built to resemble malfind. If the investigator only runs pslist, a rootkit that unlinks a process or injects a DLL into a legitimate process can remain invisible. The question specifically asks for hidden processes or injected code/DLLs, which points away from pslist and toward malfind.Community Comment Notes
jingu_bingo cites CHFIv11 page 515 for the exact phrase "hidden processes or injected code/DLLs," which aligns the official courseware with option A. Elb reinforces that malfind targets user-mode memory and injected code/DLLs, while 044f354 quotes CHFI Module 07 page 760 on detecting hidden or injected files, generally DLLs, using malfind. Another commenter points to the Volatility command reference for malfind and notes its use in finding injected code, such as through CreateRemoteThread -> LoadLibrary. The community consensus is therefore consistent with the technical reasoning, not merely a vote count.Official Reference
Exam Strategy
Map each Volatility plugin to its data source: pslist reads the active process list, while malfind inspects process memory for PE headers and injected regions. When the stem mentions hidden processes or injected code/DLLs, select malfind and reject invented plugin names such as mallist or malscan.
Frequently Asked Questions
Why is pslist not enough to find injected code in a memory dump?
pslist only walks the active process linked list, so it can miss unlinked hidden processes and does not scan process memory for injected PE regions.
What does the Volatility malfind plugin look for?
It scans process memory for suspicious executable regions and PE headers that may indicate hidden processes, injected code or injected DLLs.