Which Volatility plugin helps identify the modules loaded by each process, aiding detection of injected code?

• A. ldrmodules
• B. pslist
• C. netscan
• D. handles

Answer: (A)

Detecting code injection relies on seeing what code each process has loaded. If a malicious actor injects code, a rogue DLL often becomes one of the modules listed for the target process. The ldrmodules plugin is built to enumerate all modules loaded by every process by traversing the process's loader data structures and listing each module’s name, base address, and path. This per-process module census makes injections visible: you can spot DLLs that don’t belong to the legitimate application, come from unusual directories, or appear with unexpected base addresses or timestamps.

Other plugins focus on different artifacts. pslist simply enumerates processes, netscan reports network connections, and handles shows handles opened by processes. None of these directly reveal the set of modules loaded into each process, which is why ldrmodules is the best choice for detecting injected code.