CST 3510 Windows Memory Analysis Coursework 2 Brief 2025

Introduction

This piece of coursework will require you to perform an analysis of an infected memory sample acquired from a Windows operating system. In learning week 7 you will be placed into groups of five students and will be provided with an infected memory sample. Using this your group will carry out a series of tasks and answer several questions related to analysis of a specific area of the Windows operating system. The main goal of the analysis is to establish which parts of the operating system have changed and identify any malware or malicious activity that may have taken place. This will be achieved through comparison with a 'clean' sample acquired using winpmem.exe, and using Volatility software to perform analysis of the memory artefacts. Individual students will then analyse specific areas of interest and try to identify any malicious activity. This information will be used by the group to combine their analysis and understand how the system is infected. All of the work should be placed into a group report which is specified in this document. 

Assessment Overview 

Coursework 2 is the second of two assessments on the module and this one will contribute 50% to your final mark for the module. To pass the assessment you must obtain a minimum mark of 40% for both the group and the individual component. If you do not pass the individual component then you will not be able to use the marks for the group component and will receive a fail mark for this assessment.

Coursework Specification 

Group Report 

The final report should total no more than 15,000 words and should be written in either a size 11 or 12 font. It should be fronted with a cover page including assignment details, group number and all student numbers. Please do not include any names as this piece of work will be marked anonymously. It should also include a table of contents, a bibliography, and page numbers and ensure all images are labelled correctly. It should consist of the following chapters: 

• Introduction 
  Should provide an overview of the assessment, and explain the rationale and methodology employed. Should also explain which group member has 
• Memory Acquisition 
  Should include how you have identified the infected sample and a detailed explanation of the steps taken to acquire a memory sample and transfer it to another machine for analysis.
• Pre-analysis
  Carry out a comparative analysis of the process lists for both memory dumps, and use it to build a hierarchy showing the parent-child relationships between them.
• Examination 
  This should consist of 5 sub-chapters, one for each student's individual topic area. More details are provided below on page 4.
• Group Analysis
  Working in your groups you will share your results and attempt to understand the relationship between all of the artefacts that have been recovered and determine how the system may have been infected.
• Summary and Conclusions 
  Provide a summary of the groups findings and any other relevant information.