search

spender-sandbox / cuckoo-modified

Modified edition of cuckoo
394 stars 178 forks source link

Issue with Volatility 2.5(?) #330

Open Antelox opened 8 years ago

Antelox commented 8 years ago

I would re-open this issue (https://github.com/spender-sandbox/cuckoo-modified/issues/161) because with "Full Memory Dump" option enabled, cuckoo stuck on this

[modules.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label mytest to path /opt/cuckoo/storage/analyses/209/memory.dmp

memory.dmp file created succesfully (around 2.2GB). If I try to do:

vol.py -l memory.dmp --profile=Win7SP1x64 malfind

I get same result of the issue linked above.

Note: Installed last Volatility code from Github and VirtualBox 5.1.8

doomedraven commented 8 years ago

probably some vbox isssue, as in kvm works just fine

KillerInstinct commented 8 years ago

Try to process the memory.dmp file with volatility manually. If it gets stuck still, it would seem to be a Volatility issue and not Cuckoo. I haven't had any 'stuck' issues with volatility with dumps produced by KVM.

Antelox commented 8 years ago

@KillerInstinct it's what I have done and I got same output of https://github.com/spender-sandbox/cuckoo-modified/issues/161 I think it's an issue related to VirtualBox, as said by @doomedraven. I will try to investigate about. If someone else got same issue, please comment below. Thanks! :)