131578 20241125101137.0 doi 10.1016/j.fsidi.2023.301505 sideral 136962 ART-2023-136962 eng Fernández-Álvarez, Pedro Module extraction and DLL hijacking detection via single or multiple memory dumps 2023 Access copy available to the general public Unrestricted A memory dump contains the current state of a system's physical memory at the time of its acquisition. Among other things, it contains the processes that were running at the time of acquisition. These processes can share certain functionalities provided by shared object files, which are internally represented by modules in Windows. However, each process only maps in its address space the functionalities it needs, and not the entire shared object file. In this way, the current tools for extracting modules from existing processes in a memory dump from a Windows system obtain the partial content of a shared object file instead of the entire file. In this paper we present two tools, dubbed Modex and Intermodex, which are built on top of the Volatility 3 framework. These tools allow a forensic analyst to extract a 64-bit module from one or more Windows memory dumps as completely as possible. To achieve this, they aggregate the contents of the same module loaded by multiple processes that were running in the same memory dump or in different dumps (we called it intradump and interdump, respectively). Additionally, we also show how our developed tools are useful to detect dynamic-link library (DLL) hijacking attacks, a widely used attack on Windows where attackers trick processes into loading a malicious DLL instead of the benign one. info:eu-repo/grantAgreement/ES/DGA/T21-20R-DISCO info:eu-repo/grantAgreement/EUR/MICINN/TED2021-131115A-I00 info:eu-repo/semantics/openAccess by-nc-nd http://creativecommons.org/licenses/by-nc-nd/3.0/es/ 2.0 2023 COMPUTER SCIENCE, INTERDISCIPLINARY APPLICATIONS 106 / 170 = 0.624 2023 Q3 T2 COMPUTER SCIENCE, INFORMATION SYSTEMS 152 / 250 = 0.608 2023 Q3 T2 0.808 2023 Law 2023 Q1 Medical Laboratory Technology 2023 Q1 Pathology and Forensic Medicine 2023 Q1 Information Systems 2023 Q2 Computer Science Applications 2023 Q2 5.9 2023 info:eu-repo/semantics/article info:eu-repo/semantics/publishedVersion Rodríguez, Ricardo J. Universidad de Zaragoza (orcid)0000-0001-7982-0359 5007 570 Universidad de Zaragoza Dpto. Informát.Ingenie.Sistms. Área Lenguajes y Sistemas Inf. 44 Supplement (2023), 301505 [8 pp.] Forensic sci. int. digital invest. Forensic science international. Digital investigation 2666-2825 955852 http://zaguan.unizar.es/record/131578/files/texto_completo.pdf Versión publicada 2851787 http://zaguan.unizar.es/record/131578/files/texto_completo.jpg?subformat=icon icon Versión publicada oai:zaguan.unizar.es:131578 articulos driver 2024-11-22-12:01:29 ARTICLE