After you have identified the injected code (PE file or shellcode) in the process memory, you may want to dump it to disk for further analysis (for extracting strings, to perform YARA scans, or for disassembly). To dump a region of memory described by the VAD node, you can use the vaddump plugin. For example, if you want to dump the memory region containing the shellcode at address 0x03110000, you can supply the -b (--base) option followed by the base address, as follows. If you don’t specify the -b (--base) option, the plugin dumps all memory regions into separate files:
$ python vol.py -f spyeye.vmem --profile=Win7SP1x86 vaddump -p 1608 -b 0x03110000 -D dump/
Volatility Foundation Volatility Framework 2.6
Pid Process Start End Result
---- ----------- ---------- ---------- ---------------------------
1608 explorer.exe 0x03110000 0x03110fff dump/explorer.exe.1deb4780.0x03110000-0x03110fff.dmp
Some malware programs use stealth techniques to bypass detection. For example, a malware program may inject a PE file and wipe out the PE header after it is loaded into the memory. In that case, if you are looking at the hex dump, it will not give you any indication of the presence of PE file; some level of manual analysis may be required to verify the code. An example of such a malware sample is mentioned in a blog post titled "Recovering CoreFlood Binaries with Volatility" (http://mnin.blogspot.in/2008/11/recovering-coreflood-binaries-with.html).