diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py
index 4aaaf9bf8..98e9c4695 100644
--- a/volatility3/framework/plugins/linux/malware/malfind.py
+++ b/volatility3/framework/plugins/linux/malware/malfind.py
@@ -85,15 +85,17 @@ class Malfind(interfaces.plugins.PluginInterface):
 
             if vma.is_suspicious(proc_layer) and vma_name != "[vdso]":
                 malicious_pages = vma.get_malicious_pages(proc_layer)
+                offset = 0
                 if dump_page:
                     # Dumping each dirty page
                     for page_addr in malicious_pages:
+                        offset = page_addr - vma.vm_start
                         data = proc_layer.read(page_addr, dump_size, pad=True)
-                        yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data
+                        yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {offset:#x}", data, offset
                 else:
                     # Original behaviour - Dump the start of the region (not necessarily matching the dirty page)
                     data = proc_layer.read(vma.vm_start, dump_size, pad=True)
-                    yield vma, vma_name, data
+                    yield vma, vma_name, data, offset
 
     def _generator(self, tasks):
         # determine if we're on a 32 or 64 bit kernel
@@ -105,13 +107,15 @@ class Malfind(interfaces.plugins.PluginInterface):
         for task in tasks:
             process_name = utility.array_to_string(task.comm)
 
-            for vma, vma_name, data in self._list_injections(task):
+            for vma, vma_name, data, offset in self._list_injections(task):
                 if is_32bit_arch:
                     architecture = "intel"
                 else:
                     architecture = "intel64"
 
-                disasm = renderers.Disassembly(data, vma.vm_start, architecture)
+                disasm = renderers.Disassembly(
+                    data, vma.vm_start + offset, architecture
+                )
 
                 yield (
                     0,