Dynamic malware analysis is the detonation of the malware in a controlled environment or malware sandbox. During the execution of the malware, the incident responder is able to see the various processes that are created, the network connections that are established, additional packages that are downloaded, and if the malware performs any actions that allow it to maintain persistence. From this analysis, responders gain a better sense of the IoCs associated with the malware and are better able to identify other systems that have been impacted.
While gaining a sense of the actions malware takes when it executes, dynamic analysis has the advantage of not being as time-intensive as static analysis. Responders often do not need to understand the full depth of complexity of the malware in question, but rather have the ability to identify the IoCs associated with the...
