Volatility malfind

vol.py -f mem.dmp windows.malfind.Malfind

Searches a memory dump for injected and executable regions (MZ/header) that reveal code injection in processes.

Run it on the memory dump of a compromised host when you suspect process injection: malfind scans each process's memory regions looking for those that are executable (PAGE_EXECUTE) and contain a PE header (MZ) — the exact pattern of classic injection (CreateRemoteThread, hollowing). Each finding gives you the host process, the address, and the content: the injected payload. It is the go-to memory analysis tool to confirm that malware ran injected into a legitimate process — the scenario that file-based EDR doesn't see because there's no binary on disk.

Don't use it as your only injection search: modern techniques (injection without RWX regions, process hollowing with a clean section, overlapping modules, or loaders running from memory via NtMapViewOfSection) don't always leave the classic pattern malfind detects — combine it with windows.dlllist (modules without a file), windows.pslist (weird processes), and windows.cmdline. On large dumps, malfind is slow and generates many false candidates (compilers and JITs create legitimate executable regions): review each finding by the header and content, not just the list. And beware: it needs the correct profile — without prior windows.info, results aren't reliable.