Analyzing User Mode Dumps With WinDbg

Подробнее о видео

Windows Task Manager has made grabbing process memory a right-clickable event - Easy! For incident responders, a process dump can divulge big reveals such as malicious code execution, but wait! How do you analyze it? Windows debugger! Alissa walks through analysis of process dumps to uncover code injection, user-mode hooking and user activity.

For more information on FOR526 Advanced Memory Forensics & Threat Detection:

Speaker Bio
Alissa Torres is a SANS analyst and certified SANS instructor specializing in advanced computer forensics and incident response (IR). She has extensive experience in information security in the government, academic and corporate environments. Alissa has served as an incident handler and as a digital forensic investigator on an internal security team. She has taught at the Defense Cyber Investigations Training Academy (DCITA), delivering IR and network basics to security professionals entering the forensics community. A GIAC Certified Forensic Analyst (GCFA), Alissa holds the GCFE, GPEN, CISSP, EnCE, CFCE, MCT and CTT+ certifications.