Detecting malware is difficult, and analyzing a detected piece of malware’s behavior is even more difficult. Techniques for analysis generally fall into one of three camps: static analysis of the malicious binary on disk, dynamic analysis as the binary executes, or a hybrid approach using a snapshot of physical RAM taken as the malware executes. As the result of our DARPA Cyber Fast Track (CFT) funded research, we extend this third approach. In this session we present a novel technique for leveraging multiple snapshots of physical RAM for malware detection and analysis. We will also present DAMM, a tool for differential analysis of malware in memory The techniques presented can be utilized in any size infrastructure where malware is a threat (everywhere). The presentation will contain two scenarios based on real world malware samples, demonstrating the technique in use in a manner that attendees will be able to directly apply to their own malware analysis efforts.