When malware is executed, it can interact with a system in various ways and perform different activities. For example, when executed, a malware can spawn a child process, drop additional files on the filesystem, create registry keys and values for its persistence, and download other components or take commands from the command and control server. Monitoring a malware's interaction with the system and network will help in gaining a better understanding of the nature and purpose of the malware.
During dynamic analysis, when the malware is executed, you will carry out various monitoring activities. The objective is to gather real-time data related to malware behavior and its the impact on the system. The following list outlines different types of monitoring carried out during dynamic analysis:
- Process monitoring: Involves monitoring the...
