forensicsmedium

Reminiscent

hackthebox

Task: Memory dump from Windows VM with suspicious PowerShell activity after phishing email. Solution: Volatility process/cmdline analysis, decode base64 PowerShell payloads (ASCII and UTF-16LE), find Empire stager with embedded flag.

$ ls tags/ techniques/
memory_forensicsmalware_analysisvolatilitypowershellphishing
base64_decodingmemory_dump_analysisprocess_analysispowershell_payload_extraction
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]