Ghost in the RAM
Hard 45 ptsA full memory image to analyse with Volatility: list the processes, find the malicious one, and pull a secret out of its address space. This delivers a real dump and verifies your finding; shipping multi-megabyte images and grading them is the next forensics piece.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
This lab is being built — it needs a real memory image delivered to you.
Hint 2
When it lands: pslist, then scan the suspicious process's memory for the flag.
Interactive lab — building
This one needs a live sandbox and is being wired up. The brief and hints describe exactly what it will do; the theory lessons in this track are the on-ramp.