The last technique we will mention is incorporating memory dumps. This technique is widely used, as it's one of the easiest for most packers and protectors to use (especially if they have anti-debugging techniques), as it basically involves executing the malware and taking a memory snapshot of its process and every process it injects code into.
This technique is very beneficial for static analysis, as well for static signature scanning; however, the memory dump that is produced is different from the original sample and can't be executed. The addresses and the import table need to be fixed before any further dynamic analysis is possible.
Some common sandboxing tools provide a process's memory dump as a core feature or as one of their plugins' features, such as Cuckoo Sandbox.
Since this technique doesn't provide a clean sample, and because of the limitations of the previous automated techniques we described, understanding how to...
