System and method for analysis of a memory dump associated with a potentially malicious content suspect

A malicious content detection system, comprising:

• a hardware processor;
• and
• a memory communicatively coupled to the hardware processor, the memory comprising one or more virtual machines and a controller that is part of a virtual machine monitor and is in communications with the one or more virtual machines,
• wherein at least a first virtual machine of the one or more virtual machines comprises
• a monitoring module that includes logic to monitor behavior of a malicious content suspect during processing of the malicious content suspect within the first virtual machine to determine one or more events caused by the behavior to be stored in an event log, wherein the event log is stored within a virtual machine disk file corresponding to one or more files in a storage location of a storage device associated with the first virtual machine, and
• a memory dump module communicatively coupled to the monitoring module, the memory dump module includes logic that generates a memory dump associated with the malicious content suspect, the memory dump includes a snapshot of information in a memory region associated with or allocated to the malicious content suspect, and
• wherein the controller of the virtual machine monitor comprises
• a file extractor that includes logic that mounts, within a directory, a portion of the virtual machine disk file associated with the first virtual machine during processing of the malicious content suspect within the first virtual machine, the portion of the virtual machine disk file includes at least information generated during processing of the malicious content suspect, the memory dump and the event log, and
• an analysis module communicatively coupled to the monitoring module and the memory dump module, the analysis module configured to analyze at least the contents of the memory dump to determine whether the malicious content suspect is to be declared as malicious.

A malicious content detection system, comprising:

• a hardware processor;
• and
• a memory communicatively coupled to the hardware processor, the memory comprising one or more virtual machines and a controller in communications with the one or more virtual machines,
• wherein at least a first virtual machine of the one or more virtual machines comprises
• a monitoring module including logic to monitor a behavior of a malicious content suspect to detect that occur during processing of the malicious content suspect within the first virtual machine, wherein the one or more events being stored in an event log and the event log being stored within a virtual machine disk file,
• a memory dump module communicatively coupled to the monitoring module, the memory dump includes logic that generates a memory dump associated with the malicious content suspect, the memory dump includes a snapshot of information in a memory region associated with or allocated to the malicious content suspect, and
• a file extractor module including logic to place at least a portion of the virtual machine disk file into a directory and content stored in the memory dump or the event log is accessible by the directory,
• wherein the controller comprises
• an analysis module communicatively coupled to the monitoring module and the memory dump module, the analysis module configured to analyze at least the contents of the memory dump to determine whether the malicious content suspect is to be declared as malicious.