Fileless malware

[mark77]

Hello,

Any recommendations on tools or approach to pull apart the binary memory fragment payload of a fileless malware ?

Ghidra opens it as ram and if I dig about I can find functions but I can't work out the file structure.

Virustotal says no virus, hybrid analysis does not know what to do with the file,

I still have some powershell to deobsficate but am certain it is just the memory loader,

Any advice ?