cuckoobox/cuckoo — pull request #32 by Thorsten-Sick (2012-06-25 11:37:05+00:00)
Title: Memdump

Adds a virtual box memdump feature. Full system memdumps can be triggered before malware is injected or after it ran.

Volatility is able to open the memdumps and can be used to find traces of rootkits (1)

Not included:
- Volatility does not yet produces json logfiles
- There is no processing for this data
- Reports are not generated

This will be fixed with the next commits.

1: Volatility needs a special virtualbox plugin