Free readiness test
Home / Tool labs / Volatility 3

Volatility 3 hands-on lab The macro that phoned home

Investigate a memory dump: processes, command lines, connections and injected code.

Malware & ForensicsAdvancedPro live lab5 objectives
dfir@forensics-ws:~/ir-2291$
$ vol -f ws114.mem windows.pstree
PID    PPID   ImageFileName      CreateTime
4      0      System             2026-11-07 08:01:02
* 812  4      smss.exe
...
3020   2988   explorer.exe       2026-11-07 08:03:40
* 4410 3020   OUTLOOK.EXE        2026-11-07 08:05:12
** 5108 4410   WINWORD.EXE      2026-11-07 09:31:55
*** 5420 5108   powershell.exe   2026-11-07 09:32:03
**** 5532 5420   rundll32.exe     2026-11-07 09:32:09

What is Volatility 3?

Volatility is the leading open-source memory forensics framework. Memory reveals what was really running: malware that never touched disk, decrypted commands and live network connections.

1 Why memory

Fileless malware, injected code and decrypted payloads often exist only in RAM.

2 Plugins

windows.pslist/pstree/cmdline/netscan/malfind each answer one forensic question.

3 Process ancestry

Odd parent→child chains (Word spawning PowerShell) are strong evidence of compromise.

The scenario: The macro that phoned home

WS-114's user opened an 'invoice' document, then the EDR saw encoded PowerShell. IR captured RAM into ws114.mem before isolating it. Reconstruct the attack chain from memory.

Run this lab live in the platform

A simulated terminal with 5 objectives, hints and scenario questions. Included with NERvE Pro.

Open the Volatility 3 lab

Step-by-step: Volatility 3 commands used in this lab

1Identify the memory image's OS and build

windows.info

vol -f ws114.mem windows.info

2Show the process tree

windows.pstree shows parent → child.

vol -f ws114.mem windows.pstree

3Reveal the suspicious command lines

windows.cmdline

vol -f ws114.mem windows.cmdline

4Find network connections

windows.netscan

vol -f ws114.mem windows.netscan

5Look for injected code in the suspicious process

windows.malfind with --pid 5532

vol -f ws114.mem windows.malfind --pid 5532

Key takeaways

Install Volatility 3 and practise for real

pipx install volatility3   # then: vol -f image.mem windows.pslist

Practise with public memory samples from forensics challenges (e.g. MemLabs) in a VM. Only scan or test systems you own or are explicitly authorised to assess. Official site: volatilityfoundation.org · Licence: Volatility Software License.

Scenario questions

What was the initial access vector?

Answer: A macro-enabled Word document from email. Outlook → Word opening Invoice_Nov_8841.docm → PowerShell is a classic malicious-macro chain.

Which process hosts the injected payload?

Answer: rundll32.exe (PID 5532). malfind found an MZ header in RWX memory inside rundll32 PID 5532, which also holds the C2 connection.

Which control would most likely have stopped this?

Answer: Blocking macros from internet-sourced files and ASR rules for Office child processes. Microsoft blocks internet macros by default now; ASR rules stop Office spawning child processes.

More open-source tool labs

🧬

YARA

Describe malware by its patterns and hunt for it across files.

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🛡️

Wazuh

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.