https://www.andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/
https://www.andreafortuna.org/2017/07/03/volatility-my-own-cheatsheet-part-2-processes-and-dlls/
https://www.andreafortuna.org/2017/07/10/volatility-my-own-cheatsheet-part-3-process-memory/
https://www.andreafortuna.org/2017/07/17/volatility-my-own-cheatsheet-part-4-kernel-memory-and-objects/
https://www.andreafortuna.org/2017/07/24/volatility-my-own-cheatsheet-part-5-networking/
https://www.andreafortuna.org/2017/07/31/volatility-my-own-cheatsheet-part-6-windows-registry/
https://www.andreafortuna.org/2017/08/07/volatility-my-own-cheatsheet-part-7-analyze-and-convert-crash-dumps-and-hibernation-files/
https://www.andreafortuna.org/2017/08/21/volatility-my-own-cheatsheet-part-8-filesystem/
https://www.andreafortuna.org/2017/07/03/volatility-my-own-cheatsheet-part-2-processes-and-dlls/
https://www.andreafortuna.org/2017/07/10/volatility-my-own-cheatsheet-part-3-process-memory/
https://www.andreafortuna.org/2017/07/17/volatility-my-own-cheatsheet-part-4-kernel-memory-and-objects/
https://www.andreafortuna.org/2017/07/24/volatility-my-own-cheatsheet-part-5-networking/
https://www.andreafortuna.org/2017/07/31/volatility-my-own-cheatsheet-part-6-windows-registry/
https://www.andreafortuna.org/2017/08/07/volatility-my-own-cheatsheet-part-7-analyze-and-convert-crash-dumps-and-hibernation-files/
https://www.andreafortuna.org/2017/08/21/volatility-my-own-cheatsheet-part-8-filesystem/
Andrea Fortuna
Volatility, my own cheatsheet (Part 1): Image Identification
In order to start a memory analysis with Volatility, the identification of the type of memory image is a mandatory step. Here some usefull commands. imageinfo For a high level summary of the memory sample you’re analyzing, use the imageinfo command. Most…
Malware analysis - Emotet droppers:
https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/
https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/