Analysis of malware in memory with Mandiant Audit Viewer and Memoryze

Mandiant Audit Viewer and Memoryze can be used to help an analyst find malware in memory, including rootkits. Signatures are not used. An article detailing use of Audit Viewer can be found at http://computer-forensics.sans.org/...sics-howto-memory-analysis-mandiant-memoryze/.

A nice feature of Audit Viewer is Malware Rating Index, which gives a numerical score to each process based on how suspicious it is.

Using the option "extract strings" may take a great deal of time, and thus shouldn't be used if not needed.

These programs work on x64 too, including Windows 7 x64 .

 

I should also mention that Audit Viewer highlights any process in red that has an injected DLL.

Another nice feature of Audit Viewer is the ability to identify DLL load order attacks.

 

thanks @Mrbrian ...i have been using it for 3 months and it's really awesome tool though sometimes causing my pc to hang

 

Mandiant Red Curtain has been awesome, too.