AUTOMATED RAM MEMORY FORENSIC TOOL FOR MALWARE ANALYSIS AND THREAT DETECTION

Abstract

Advanced cyber threats such as fileless malware, ransomware, and process injection attacks often reside in volatile memory, making them difficult to detect using traditional disk-based forensic techniques. This paper presents an Automated RAM Memory Forensic Tool for Malware Analysis and Threat Detection that integrates memory acquisition, forensic artifact extraction, signature-based detection, and artificial intelligence into a unified framework. The proposed system utilizes WinPmem for memory acquisition, Volatility 3 for extracting forensic artifacts, and YARA rules for identifying known malware signatures. Machine Learning and Deep Learning models are employed to detect unknown and obfuscated malware, while an ensemble decision mechanism improves detection accuracy and reduces false positives. The framework also performs automated IOC correlation, severity assessment, timeline reconstruction, and forensic report generation through a Streamlit-based interface. Experimental results demonstrate that the proposed approach improves malware detection efficiency, reduces manual investigation effort, and provides an effective solution for modern memory forensic analysis and incident response.