In the event that an analyst is able to identify a suspect process within the memory image, the dlldump plugin can be utilized to dump the contents of those DLL files to the local system. This allows the analysts to examine the contents of the DLL files and compare them to legitimate files to determine whether they are malicious. For example, the process that has been identified, Reader_sl.exe with the PID of 1640, was identified as potentially malicious in several sections of this chapter. To acquire the DLL files and have them accessible to the local system, type the following:

dfir@Desktop-SFARF6G~$ volatility -f cridex_laptop.mem --profile=WinXPSP2x86 -p 1640 dlldump --dump-dir /mnt/d/Suspicious_Process_PID_1640/

The command produces the following:

Next, we will be looking at the executable dump.