thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Dynamic Malware Analysis

Executing malware in a controlled environment to observe its behavior, network activity and system changes.

Definition

Dynamic analysis monitors process creation, file and registry changes, network connections and API calls while the sample runs, typically in an isolated sandbox or VM with tools such as Process Monitor and Wireshark. It reveals behavior hidden by packing but may be evaded by sandbox-aware malware.

Example

Detonating a sample in a VM and seeing it create a run key and contact 185.x.x.x on port 443.

Exam tip

Dynamic analysis must be done in an isolated environment to prevent spread.

Related terms