Memory Forensics Basics

Acquire a memory image from a compromised Windows host and analyze it with Volatility 3: list processes, hunt for code injection with malfind, inspect network connections, and identify an injected process that disk artifacts never reveal.