> For the complete documentation index, see [llms.txt](https://dika-maulidal.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dika-maulidal.gitbook.io/home/writeups-and-walkthroughs/tryhackme-thm/critical-writeup.md). # Critical Writeup
{% embed url="" %} ## Task 2: Memory Forensics **2.1** What type of memory is analyzed during a forensic memory task? ``` RAM ``` **2.2** In which phase will you create a memory dump of the target system? ``` Memory Acquisition ``` ## Task 3: Environment & Setup **3.1** Which plugin can help us to get information about the OS running on the target machine? ``` Windows.info ``` **3.2** Which tool referenced above can help us take a memory dump on a Linux OS? ``` LIME ``` **3.3** Which command will display the help menu using Volatility on the target machine? ``` vol -h ``` ## Task 4: Gathering Target Information **4.1** Is the architecture of the machine x64 (64bit) Y/N?
``` Y ``` **4.2** What is the Version of the Windows OS
``` 10 ``` **4.3** What is the base address of the kernel?
``` 0xf8066161b000 ``` ## Task 5: Searching for Suspicious Activity **5.1** Using the plugin "windows.netscan". Can you identify the destination IP address where a connection is established on port 80? ```bash vol -f memdump.mem windows.netscan ```
``` 192.168.182.128 ``` **5.2** Using the plugin "windows.netscan," can you identify the program (owner) used to access through port 80? ``` MSEdge.exe ``` **5.3** Analyzing the processes present on the dump, what is the PID of the child process of critical\_updat? ```bash vol -f memdump.mem windows.pstree ```
``` 1612 ``` **5.4** What is the time stamp time for the process with the truncated name critical\_updat?
``` 2024-02-24 22:51:50.000000 ``` ## Task 6: Finding Interesting Data **6.1** Analyzing the "windows.filescan" output, what is the full path and name for critical\_updat?
``` C:\Users\user01\Documents\critical_update.exe ``` **6.2** Analyzing the "windows.mftscan.MFTScan" what is the Timestamp for the created date of important\_document.pdf?
``` 2024-02-24 20:39:42.000000 ``` ***