volatility3 pslist

vol.py -f mem.dmp windows.pslist

Lists processes from the memory dump with Volatility 3, the base inventory of forensic analysis to detect anomalous processes.

Run it at the start of the analysis of a dump: pslist gives you the processes that were running at the time of capture, with PID, PPID, timestamps, and the executable path. It's the first question of memory IR — 'what was running?' — and the basis for detecting the anomalous: processes with legitimate names from user paths, weird PPIDs, creation times that don't match system boot. The analysis is done by comparing against the host baseline (the system processes that are always there) and looking for what's extra. In a dump from a compromised host, pslist is where it all starts.

Don't use it as a verdict: pslist sees what the dump contains — processes hidden by rootkits or those that have already terminated don't show up (for those, there are psscan and kernel structures). The process list of a normal Windows system is long and system names (svchost, lsass, csrss) repeat: without knowing the host baseline, it's easy to flag noise or miss the anomalous. And watch out for the profile: without prior windows.info, offsets can be wrong and the list comes out corrupted. The executable path is the key field: a legitimate process from Temp or Downloads is the typical finding.