Memory forensics is a key technique for detecting and analyzing malware and related attack tools. While there are several memory forensics tools, the Volatility framework is probably the most widely used and significant tool. Volatility features a large number of commands, which for Windows systems roughly fall into two categories. One consists of commands that are more directly geared towards detecting malware specific artifacts such as code injections, or various kinds of hooks. The other category consists of commands that allow inspecting the state of the system being investigated. For instance, one can display running processes, loaded DLLs, drivers, etc. To detect malware using the latter tools, the analyst is typically looking for anomalous system properties. A simple example would be a bogus process name or processes which are started from unusual directories. Stuxnet for instance, introduces two malicious instances of the alleged “lsass.exe” process, which feature a wrong parent process. Another, more subtle anomaly, would be an unusually low or high number of DLLs in a certain process. The key point is that finding these anomalies requires lots of encyclopedic knowledge about the state of a non-infected Windows system. This knowledge is hard to memorize (at least for some of us). Moreover, searching for actual discrepancies deviating from the clean state can be a quite boring and rather mechanical task. Due to laziness and lack of brain capacity we have developed a Volatility based tool that automates the process of finding certain anomalies in memory images. The idea underlying our tool is on a high level rather straightforward: We first generate a whitelist of known clean memory states, and then detect malware by checking for deviations from the whitelist. The anomalies are described in a report that is automatically generated by the tool. The tool thus allows to detect certain anomalies more efficiently and likely covers more anomalies than most humans will be able to memorize. Let us sketch in some more detail how our tool works. We first obtain memory images of known clean systems, and extract from these images a large number of properties (e.g., parent – child relationships of processes, drivers loaded, which process contains what DLLs, and many many more) using various Volatility tools. The resulting data is stored in a database. To analyze a potentially infected image, we again perform property extraction using Volatility, and then check the resulting values against the whitelist stored in the database. Another more advanced and “researchy” component of the tool does not use Volatility, but rather takes a “binary diffing” approach by comparing known clean memory images with the image to be analyzed. A simple byte-wise diffing won’t be successful; our tool rather has the capability to identify relevant modifications. This diffing approach allows finding, for instance, hooks and memory injections using a different method than the heuristics used by the malware tools of Volatility. Moreover, by combining both approaches we can reduce the false positive rate of the current Volatility tools. We have tested our tool with real world malware samples and the results are encouraging. For instance, in the case of Stuxnet, we can automatically identify many of its infection characteristics, with a relatively moderate false positive rate. We believe that our tool is quite useful for practitioners, and we are going to opensource it in the second half of 2014.