RogueOne memory forensics Challenge


This lab is made by HackTheBox.

Lab Scenario

“Your SIEM system generated multiple alerts in less than a minute, indicating potential C2 communication from Simon Stark’s workstation. Despite Simon not noticing anything unusual, the IT team had him share screenshots of his task manager to check for any unusual processes. No suspicious processes were found, yet alerts about C2 communications persisted. The SOC manager then directed the immediate containment of the workstation and a memory dump for analysis. As a memory forensics expert, you are tasked with assisting the SOC team at Forela to investigate and resolve this urgent incident.”

Downloading the Memory Dump / Running on the Cloud Lab

Please visit the lab official link.

Used Tools


  • To uncompress the lab file (pass: hacktheblue)
  • The lab is FREE at the time of writing this post (if retired, it will be paid and only for VIP users)


In this blog, I briefly notified you about a newly released memory forensic challenge.

~ Cya in the Next One