Dynamic Analysis

Dynamic analysis runs the malware in a controlled environment and observes its behavior: files created, registry changes, processes spawned, and network traffic.

It reveals what the sample actually does, including behavior hidden from static analysis by packing.

Run malware only in an isolated sandbox: a virtual machine with a clean snapshot you can revert to.

Use a host-only or fake network so the malware cannot reach the internet or your real systems. Never analyze on a machine connected to a production network.

Before detonating the sample, take a clean VM snapshot. After analysis, revert to it to wipe any changes the malware made.

This lets you run the sample repeatedly from an identical starting state.

Procmon (Process Monitor) records file, registry, and process activity in real time. Filtering by the sample's process name shows exactly what it touches.

This reveals dropped files, created registry keys, and persistence mechanisms.

Process Explorer and Process Hacker show running processes, parent-child relationships, and injected threads.

Malware often spawns child processes or injects into legitimate ones like explorer.exe to hide.

Use Wireshark to capture traffic and INetSim or FakeNet-NG to simulate internet services. The malware thinks it reached its server, while you safely log the requests.

This exposes command-and-control domains, beacons, and exfiltration attempts.

From dynamic analysis you collect Indicators of Compromise (IOCs):

• File hashes and dropped file names.
• Registry keys for persistence.
• C2 domains and IP addresses.
• Mutex names.

IOCs help defenders detect and block the threat.

Watch for how the malware survives reboots. Common methods include:

• Run keys in the registry.
• Scheduled tasks.
• Services.
• Startup folder entries.

The persistence location is a high-value IOC and removal target.

Sophisticated malware detects sandboxes and refuses to run. It may check for VM artifacts, low uptime, few CPU cores, or debugger presence.

Some delay execution or require user interaction. Recognizing these evasion tricks is part of dynamic analysis.

Tools like Cuckoo Sandbox and online services (Any.Run, Hybrid Analysis) automate detonation and produce behavior reports.

They speed up triage, but careful manual analysis still catches what automation misses, especially evasive samples.

Static and dynamic analysis complement each other. Static work reveals capabilities and hints; dynamic work confirms what actually executes.

An analyst typically loops between them: a string found statically guides what to watch dynamically, and observed behavior points back to code to read in the disassembler.

Recall the key safety step before detonating malware.

You now understand dynamic malware analysis:

• Run the sample in an isolated VM with a clean snapshot and simulated network.
• Monitor with Procmon, Process Explorer, and Wireshark + INetSim.
• Collect IOCs and identify persistence mechanisms.
• Watch for anti-analysis evasion tricks.

Next you will read the code itself with disassembly.