volatility3 malfind

vol.py -f mem.dmp windows.malfind

Searches for injected and executable memory regions (RWX with PE header) in the dump, the signature of code injection in processes.

Run it when pslist or the EDR suggest injection: malfind scans each process's memory regions for executable ones (PAGE_EXECUTE_READWRITE) that contain an MZ header — the pattern of classic injection (CreateRemoteThread, hollowing). Each finding gives you the host process, the address, and dumpable content: the injected payload, analyzable later with YARA or the sandbox. It's the confirmation of the scenario that file analysis doesn't see: malware running injected into a legitimate process without a binary on disk.

Don't use it as the only injection search: modern techniques (injection without RWX, hollowing with clean sections, overlapped modules) don't always leave the classic pattern — combine it with windows.dlllist (modules without file) and windows.hollowing. malfind generates false positives with legitimate regions (JITs, compilers): each finding is confirmed by dumping the region and looking at the content, not just the header. On large dumps it's slow: narrow by process if the suspect is already identified. And the correct profile is mandatory: without windows.info, results aren't reliable.