Diagnosing Malware with Resource Monitor

ronjor · Jul 19, 2012

by Mark Baggett (Version: 1)

Window’s Resource Monitor is a hidden gem within the OS that can be very useful to an incident responder in a crunch. It isn’t as comprehensive as SysInternals Process Monitor but it is built in to Windows so you can use it on a computer with no internet connection. It lacks the depth of WMIC but it does have a very nice GUI (if you are into that sort of thing). In short, resource monitor is a worthy addition to the incident responders toolkit. Resource Monitor isn’t a separate program, but rather it is an operational mode for Performance Monitor (Perfmon.exe). If you start Performance Monitor with the "/res" option you will see the Resource Monitor interface. Click START->Run and type “Perfmon.exe /res” and press Enter. Here is what it looks like
Click to expand...

https://isc.sans.edu/diary.html?storyid=13735

stapp · Jul 19, 2012

Thanks for the link ron.

Interesting.

Log in or Sign up

Diagnosing Malware with Resource Monitor

ronjor Global Moderator

stapp Global Moderator

Log in or Sign up

Diagnosing Malware with Resource Monitor

ronjor Global Moderator

stapp Global Moderator

Useful Searches