Re: [Vol-users] Attributing a string to a program

Hi, Have a memory dump which I have obtained via DumpIt, I'm then pretty happy and can use Volatility to find out some of the answers to my questions. However when I have run Strings on the memory dump I find a string of great interest. I would like to figure out a means by which I could find out what created this string. So far I've created a basic Yara rule and used malfind to no avail. Is there anything else I could try? Cheers David _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users