Memory forensics · Volatility 3 orchestration · DFIR analysis
VolMemLyzer3 is an orchestration and analysis layer around Volatility 3. It schedules forensic plugins according to their dependencies, reuses completed artifacts, correlates evidence across plugin outputs, and exposes the same evidence to both analysts and downstream feature pipelines.
Problem
One plugin answers one forensic question. A case usually asks many: which processes exist, which views disagree, what they loaded, where they executed from, which handles and privileges they hold, what network state exists, whether private executable memory is present, and what persistence or kernel artifacts deserve review.
Some plugins are fast; pool scans and cross-view operations can dominate a run. Treating every plugin as an independent command turns case setup into manual scheduling.
Some extractors need context produced by others. Starting work too early is incorrect; waiting for unrelated slow work is unnecessary.
Volatility outputs are separate artifacts. Investigative hypotheses often require evidence spread across several of them.
System design
Volatility remains the forensic engine. VolMemLyzer controls execution, dependency release, caching and the interpretation layers that consume the resulting artifacts.
Dependency-aware concurrency
The scheduler does not drain synchronized topological layers. It reaps completions individually and releases a dependent operation the moment its own prerequisites are satisfied.
Illustration of the older failure mode.
The A-dependent work waits for unrelated B because the whole layer must drain.
A dependent starts when its own prerequisite completes.
The scheduler also commits dependency context before submitting downstream extractors, preserving correctness.
Measured execution
The committed benchmark runs the same 10-plugin extraction set against a 4.41 GB Windows image. Serial and parallel runs disable the artifact cache. Warm-cache measures reuse, not a faster Volatility engine.
| Configuration | Median | Range |
|---|---|---|
| Serial | 172.16 s | 166.57–173.79 |
| 4 workers | 71.12 s | 69.49–73.50 |
| Cache warm | 3.1517 s | 3.1483–3.4141 |
Peak RSS rises from about 305 MB serial to 613 MB at four workers; warm-cache median peak RSS is about 110 MB. The benchmark therefore shows a wall-clock/memory trade-off.
Artifact reuse
Forensic triage
The analysis layer spans six surfaces and uses explicit predicates. Observations that represent the same underlying hypothesis share an evidence family; only the strongest member of that family contributes to the object score.
Cross-view disagreement, hidden/terminated process context, lineage, execution location and related process evidence.
Review of private executable regions and corroborating loader/payload observations.
Connection and socket evidence when deep collection provides netscan.
Registry hives, scheduled tasks, UserAssist and related execution/persistence context.
Specialized SSDT-oriented integrity review under deep collection.
Image and execution context that supports interpretation of the other surfaces.
object score = min(30, Σ strongest_weight[hypothesis_family])
The score is ordinal evidence prioritization, not malware probability, confidence, or a confirmed ATT&CK technique.
Exact rule explorer
This table is populated directly from docs/ANALYSIS_RULES.md when the page loads. It extracts rule tables containing a Flag and Exact condition column, so the browser presentation does not become a second source of truth.
| Section | Flag | Exact condition | Weight | Investigative hypothesis | ATT&CK |
|---|---|---|---|---|---|
| Loading… | |||||
If browser security blocks the live fetch from a local preview, open the canonical rule specification. On GitHub Pages the explorer can load it normally.
Observed triage snapshot
This example is taken from the current MemTriage/VolMemLyzer analysis output. The purpose is not to present a synthetic “validation score,” but to show what the correlated evidence model actually produces for an analyst: ranked objects, bounded scores, confidence, evidence explanations, and ATT&CK-aligned context.
Highest-priority object
malware.exe (PID 2580)| Field | Observed value |
|---|---|
| Parent PID | 3768 |
| Risk | Critical |
| Score | 23.6 / 30 (displayed as 24/30 in the compact view) |
| Confidence | 94.6% |
| Signals | malfind_rwx_private, corr_credential_theft, malfind_peb_walk, token_sedebug |
Why it surfaced
| Evidence | Contribution | Confidence |
|---|---|---|
| RWX private memory region | +8.4 | 70% |
| Corroborated credential access | +6.0 | 85% |
| PEB loader-list walk | +4.8 | 60% |
| Sensitive privilege enabled | +4.4 | 55% |
The detailed contributions total 23.6. The compact object list rounds the displayed score to 24/30.
| Object | Risk | Score | Confidence | Primary signals |
|---|---|---|---|---|
powershell.exe (3768) | Critical | 23.6/30 | 94.6% | malfind_rwx_private, corr_credential_theft, lolbin_from_service_host, +1 |
powershell.exe (5088) | Critical | 23.6/30 | 94.6% | malfind_rwx_private, corr_credential_theft, lolbin_from_service_host, +1 |
winlogon.exe (688) | High | 15.2/30 | 95.5% | core_proc_wrong_path, token_sedebug |
smss.exe (372) | Medium | 10.8/30 | 90.0% | core_proc_wrong_path |
SearchHost.exe (5292) | Medium | 8.4/30 | 70.0% | malfind_rwx_private |
Alignment is used for triage context, not as a claim of confirmed adversary activity.
| Technique | Observed alignments |
|---|---|
T1134 · Access Token Manipulation | 40× |
T1055 · Process Injection | 10× |
T1036 · Masquerading | 7× |
T1003.001 · LSASS Memory | 3× |
T1053.005 · Scheduled Task | 3× |
T1059 · Command and Scripting Interpreter | 2× |
Collection modes
| Surface | Quick artifacts | Additional deep artifacts |
|---|---|---|
| Bearings | windows.info | — |
| Process census | pslist, pstree | psscan, psxview |
| Executable private memory | malfind | — |
| Network | skipped | netscan |
| Persistence / history | hivelist, scheduled tasks, UserAssist | hivescan |
| Kernel dispatch | skipped | ssdt |
Claim boundaries
A surfaced object is a review lead, not a classification.
A failed plugin is unavailable, not clean.
Correlated observations contribute once per hypothesis family.
Names and paths can support review; they do not prove adversary behavior.
Executable-memory protection alone does not establish maliciousness.
Network context without protocol or reputation evidence remains supporting context.
Downstream use
MemTriage consumes VolMemLyzer's extraction/artifact layer rather than re-running the memory image for every downstream interaction. The separate feature report documents the quantitative schema used by statistical and model-oriented consumers.