Unit 6: Advanced Malware Detection Using Memory Forensics - Practice Quiz

1 What is code injection?

2 Which memory region is most suspicious for injected code?

3 Which Volatility plugin is commonly used to find injected code in process memory?

4 What happens during process hollowing?

5 Why do attackers use a legitimate process for process hollowing?

6 Which finding may indicate that a process has been hollowed?

7 What is an API hook?

8 Which change commonly indicates an inline API hook?

9 Where does a kernel-mode rootkit operate?

10 Why are kernel-mode rootkits difficult to detect?

11 What is a kernel module in Windows commonly called?

12 Which Volatility plugin lists loaded kernel modules?

13 What does I/O stand for in operating systems?

14 What structure commonly represents an I/O request in the Windows kernel?

15 What does a device tree show during memory analysis?

16 Why is displaying a device tree useful in malware analysis?

17 What is kernel-space hooking?

18 Which Windows table has historically been targeted by kernel hooks?

19 What is a kernel callback?

20 What is the main purpose of a kernel timer?

21 A memory scan finds a private memory region marked as executable and writable inside a signed browser process. Which additional finding most strongly supports code injection?

22 A suspicious process has a thread whose start address points to a memory region outside all loaded modules. What is the most appropriate interpretation?

23 During hollow process investigation, a process image path identifies a trusted executable, but its main executable region in memory differs substantially from the file on disk. What should an analyst examine next?

24 Which combination is most consistent with process hollowing?

25 A function in a system library begins with a relative jump to an address inside an unknown private executable region. What does this most likely indicate?

26 A memory-forensics tool reports that a process import address points to an address outside the expected DLL. Which conclusion is most appropriate?

27 Why is comparing an in-memory API function with a trusted copy from disk useful during hook detection?

28 A rootkit hides a process from ordinary process listings but the process remains visible through raw kernel memory scanning. What technique is most likely involved?

29 Which observation provides the strongest initial evidence of a kernel-mode rootkit?

30 A memory image contains an executable kernel region that is absent from the standard loaded-module list. Which next step is most useful?

31 Why should an analyst compare a conventional kernel-module listing with a memory scan for driver objects?

32 A suspicious driver is associated with an I/O request path that redirects requests to a nonstandard function address. What does this most directly suggest?

33 An analyst traces a file-system request and finds that the device stack contains an unexpected filter driver. What is the primary security concern?

34 When reviewing a device tree, which finding deserves the closest investigation?

35 What is the main value of displaying a device tree during memory-forensics analysis?

36 A kernel dispatch-table entry points into an executable region that does not belong to any trusted module. What is the best assessment?

37 A system call table contains a pointer outside the expected kernel image and loaded driver ranges. What should the analyst do first?

38 A kernel callback registration points to code in an unrecognized driver region. Why is this significant?

39 A periodic kernel timer has a deferred routine address inside an unknown executable allocation. What behavior could this support?

40 Which correlation most increases confidence that a suspicious kernel callback is malicious?

41 A memory image shows a process with a private PAGE_EXECUTE_READ VAD containing high-entropy code but no PE header. A thread's start address lies inside this VAD, and the region has no mapped file. Which interpretation is best supported?

42 An analyst finds an executable private VAD in explorer.exe, but executable private memory can also be created by JIT runtimes. Which additional artifact most strongly distinguishes injected shellcode from normal JIT-generated code?

43 A suspicious region is marked MEM_IMAGE rather than MEM_PRIVATE, has no corresponding loader-list entry, and contains a valid PE whose imports were resolved in memory. Which injection technique best explains these findings?

44 In a suspended process, the PEB reports an image base of 0x400000. The VAD at that address contains a PE whose timestamp, entry point, and section hashes differ from the executable named in the process audit information. What is the strongest conclusion?

45 Which artifact combination provides the strongest memory-forensic evidence of process hollowing rather than ordinary reflective DLL injection?

46 A hollowed process retains a legitimate image path and normal PEB loader entry, but memory pages corresponding to the main executable differ extensively from the disk file. Which comparison best avoids false positives caused by relocations and import resolution?

47 The first bytes of an exported function in ntdll.dll contain an unconditional jump to private executable memory. The disk version begins with the expected function prologue. Which validation most directly confirms an inline hook?

48 An application's import table entry for CreateFileW points into a signed endpoint-security DLL rather than KernelBase.dll. What is the most defensible analytical conclusion?

49 A comparison of a loaded DLL with its disk image reports hundreds of modified code bytes. The module was relocated, supports hotpatching, and contains dynamically generated stubs. Which method most reliably isolates malicious hooks?

50 Pool scanning identifies a valid-looking DRIVER_OBJECT with executable code and device objects, but no corresponding entry exists in PsLoadedModuleList. Which rootkit behavior best fits this cross-view discrepancy?

51 A suspected rootkit has patched a kernel data structure, but acquisition occurred during heavy system activity. Which evidence most strongly reduces the chance that the discrepancy is merely an inconsistent memory snapshot?

52 A list walk reports 143 loaded kernel modules, while a pool scan reports 147 candidates. What is the best procedure for interpreting the four additional scan results?

53 A kernel module list entry names netflt.sys, but its reported base maps mostly to non-executable pages and lacks a valid PE image. Pool scanning finds a valid netflt.sys image elsewhere. Which explanation is most suspicious?

54 A driver's MajorFunction[IRP_MJ_CREATE] pointer resolves to executable nonpaged pool outside every loaded module. Other dispatch entries point inside the driver's image. What is the most likely interpretation?

55 A pending IRP's completion routine points into an unloaded driver's former address range, while the IRP remains queued on an active device. Why is this artifact security-relevant?

56 A storage device tree contains an unrecognized device object attached above the filesystem's normal filter stack. Its driver has no service entry, and its read dispatch routine enters private kernel memory. What is the strongest assessment?

57 When reconstructing an attached device stack from memory, an analyst starts at the physical device object and follows only AttachedDevice pointers upward. Which limitation must be considered?

58 A naive x64 SSDT parser treats each table entry as an absolute pointer and reports thousands of invalid hook targets. What is the most appropriate correction?

59 An interrupt descriptor table entry points inside a legitimate signed driver rather than the kernel's normal interrupt handler. Which finding would most strongly elevate this from unusual behavior to likely malicious hooking?

60 A process-creation callback resolves to an unsigned driver that is absent from the loaded-module list. The callback remains registered, and its code pages are executable and referenced by a live driver object. What is the best interpretation?