Which Volatility Plugin Identifies Hidden Processes and Injected DLLs?

312-49v10 By islever Editorial Last updated Oct 17, 2026

Malware Forensics

Short answer

A The Volatility malfind plugin detects hidden processes and injected code or DLLs in a RAM memory dump.

Question

Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?

malfind Correct Answer
pslist
mallist
malscan

Key Takeaways

The question tests which Volatility plugin exposes hidden or injected user-mode memory artifacts, and the trap is choosing pslist, which only enumerates processes from the active list.

Volatility's malfind plugin scans a RAM dump for hidden processes and injected code or DLLs, making it the correct tool for this memory-forensics scenario. The page explains why pslist, mallist and malscan do not satisfy the requirement.

Common mistake: Many candidates pick pslist because it is the best-known process-listing plugin, but it walks the active process linked list and will not reveal unlinked hidden processes or injected code/DLL regions.

Expert Analysis

Why the Answer Is Correct

Volatility's malfind plugin is purpose-built for memory forensics: it scans process memory for executable regions that contain PE headers or other suspicious artifacts, which often indicate hidden processes, injected code or injected DLLs. In a RAM dump from a compromised victim, this plugin helps the investigator pivot from a suspicious PID identified by process-listing plugins into the memory region that contains the injected payload. The CHFI material cited by jingu_bingo directly pairs malfind with detecting "hidden processes or injected code/DLLs," and Elb adds that the plugin works on "injected code/DLLs in user mode memory." That is exactly the requirement in the question stem, so option A is the defensible choice.

Why the Other Options Are Wrong

pslist walks the active process doubly-linked list and prints running processes, so it is useful baseline triage but does not by itself expose hidden or unlinked processes and does not identify injected code/DLL regions. mallist and malscan are not standard Volatility plugins for this purpose; they are plausible-sounding distractors built to resemble malfind. If the investigator only runs pslist, a rootkit that unlinks a process or injects a DLL into a legitimate process can remain invisible. The question specifically asks for hidden processes or injected code/DLLs, which points away from pslist and toward malfind.

Community Comment Notes

jingu_bingo cites CHFIv11 page 515 for the exact phrase "hidden processes or injected code/DLLs," which aligns the official courseware with option A. Elb reinforces that malfind targets user-mode memory and injected code/DLLs, while 044f354 quotes CHFI Module 07 page 760 on detecting hidden or injected files, generally DLLs, using malfind. Another commenter points to the Volatility command reference for malfind and notes its use in finding injected code, such as through CreateRemoteThread -> LoadLibrary. The community consensus is therefore consistent with the technical reasoning, not merely a vote count.

Official Reference

https://code.google.com/archive/p/volatility/wikis/CommandReferenceMal22.wiki#:~:text=The%20malfind%20command%20helps%20find,process%20using%20CreateRemoteThread%2D%3ELoadLibrary

This link opens the official vendor documentation in a new tab.

Exam Strategy

Map each Volatility plugin to its data source: pslist reads the active process list, while malfind inspects process memory for PE headers and injected regions. When the stem mentions hidden processes or injected code/DLLs, select malfind and reject invented plugin names such as mallist or malscan.

Frequently Asked Questions

Why is pslist not enough to find injected code in a memory dump?

pslist only walks the active process linked list, so it can miss unlinked hidden processes and does not scan process memory for injected PE regions.

What does the Volatility malfind plugin look for?

It scans process memory for suspicious executable regions and PE headers that may indicate hidden processes, injected code or injected DLLs.

More 312-49v10 FAQ →

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Elb 👍 2 Answered A

The malfind plugin is used to identify hidden processes or injected code/DLLs in user mode memory
jingu_bingo 👍 2 Answered A

CHFIv11 page 515: "malfind...hidden processes or injected code/DLLs..."
044f354 👍 1 Answered A

ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 07 Page 760 "Detecting hidden files in memory using malfind plugin Running the malfind plugin helps forensic investigators detect hidden or injected files, which are generally dynamic-link library (DLL) files, in the memory. If the output from the pstree plugin indicates that a particular PID is suspicious, investigators should run the malfind plugin on that PID to determine its legitimacy." ----- If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.
Elb 👍 1

A < https://code.google.com/archive/p/volatility/wikis/CommandReferenceMal22.wiki#:~:text=The%20malfind%20command%20helps%20find,process%20using%20CreateRemoteThread%2D%3ELoadLibrary.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to 312-49v10 Study Guide