Function MemoryAnalysis

analysis.go:94–127

MemoryAnalysis sub-routine for running processes analysis

(proc *ProcessInformation, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules)

// MemoryAnalysis sub-routine for running processes analysis
func MemoryAnalysis(proc *ProcessInformation, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
	if pVerbose {
		logMessage(LOG_INFO, "[INFO] [MEMORY] Analyzing", proc.ProcessName, "PID:", proc.PID)
	}

	result := PerformYaraScan(&proc.MemoryDump, rules, pVerbose)
	if len(result) > 0 {
		// windows notifications
		if pNotifications {
			NotifyUser("YARA match", proc.ProcessName+" - PID:"+fmt.Sprint(proc.PID)+" match "+fmt.Sprint(len(result))+" rules")
		}

		// logging
		for _, match := range result {
			logMessage(LOG_INFO, "[ALERT]", "[MEMORY] YARA match", proc.ProcessName, "PID:", fmt.Sprint(proc.PID), match.Namespace, match.Rule)
		}

		// dump matching process to quarantine
		if len(pQuarantine) > 0 {
			logMessage(LOG_INFO, "[INFO]", "DUMPING PID", proc.PID)
			err := QuarantineProcess(proc, pQuarantine)
			if err != nil {
				logMessage(LOG_ERROR, "[ERROR]", "Cannot quarantine PID", proc.PID, err)
			}
		}

		// killing process
		if pKill {
			logMessage(LOG_INFO, "[INFO]", "KILLING PID", proc.PID)
			KillProcessByID(proc.PID, pVerbose)
		}
	}

}

// QuarantineProcess dump process memory and cipher them in quarantine folder
func QuarantineProcess(proc *ProcessInformation, quarantinePath string) (err error) {