Malware keeps evolving and becomes more dangerous and harmful. Meanwhile, anti-analysis malware and evasive malware also increased, that caused traditional analysis platforms and detection methods gradually reduce their effectiveness. To solve these problems, we propose a malware detection method based on memory and visualization on Kernel-based Virtual Machine (KVM) called MDMV. MDMV employs KVM as the analysis platform, and dumps the physical memory of the virtual machine (VM) into snapshot files out of VM, which can capture the malware’s footprint in memory. Then MDMV extracts and converts a key part of the dumped memory file to a grayscale image through Simhash, and utilizes local binary patterns (LBP) to further extract image features. These images are used to train a ResNet18 model enhanced with a self-attention module. Malware has difficulty disguising its footprint in the memory when it is running, therefor MDMV can resistant to evasive malware. MDMV exhibits strong transparency, security, and the ability to detect sophisticated malware. The best accuracy result on the experiment can reach 99.56% on our dataset, which samples are mainly collected from VirusShare. MDMV also has the ability to distinguish different malware families.