Your assignment is to analyze the following four files collected with Taskmanager's built-in process dumper from a Windows 7 client machine:
In the following table, there are four fields: the first is the dump file, which you can download. The second is the process image name given by Taskmanager. The third field is a md5sum of the dump file. The fourth field is a sha1sum of the dump file. (The last two are given so that you can verify that you successfully downloaded the files in the correct binary format.)
| File as collected by Taskmanager | Process image name | md5sum | sha1sum |
|---|---|---|---|
| chrome.DMP | chrome | ddc7277eca4c7de76421f5b2bfbb347e | f5a2e970dbb37c296a2c35c16c0130a54692a312 |
| iexplore.DMP | iexplore | 9712ffab7f117dc0171b64f504f82ae2 | 047da05aa801926067ddb29e5c02ecd17c9bcf11 |
| ollydbg.DMP | ollydbg | 8361f2495cb244b91e2333a49b0ee538 | c60dddb3f7dae50ccdda3a52bd9f9d0f7e59a607 |
| PEview.DMP | PEview | 3fc00a227add71ecb2cc3ac69801f5f9 | 7a06d081e149b1deba6958b9f129a37804e08bb3 |
I will leave it up to you to decide what tools you wish to extract information from these memory dumps, but I will note that there is relevant discussion of working with process dumps in Malware Forensics.
I am looking for (1) an analysis of what kind of information that you hope to find based on intelligent guesses developed from the process names (2) how much useful raw data you are able to extract (3) how well you can then analyze the raw data to come up with descriptions of what the processes are and what they have been doing.
I expect only one work product, a printed write-up. Please bring the write-up to class on Monday, March 4th.
This is not a collaborative assignment. Please do not discuss your work on this assignment with your classmates.
Deliverables: For the write-up, create a short narrative of your experiences and include extracts showing relevant raw data. Describe what programs you used for analysis, and what operating systems you used to run these programs. Finally, I want descriptions of your guesses as to (1) what the processes are and (2) what they have been doing.
Print out the write-up of your experiences, and give that to me at the beginning of class on March 4th.