Lab Analysis: Basic Dynamic Analysis
Lab 3-3:
1. Using the Process Explorer tool to monitor run-time activity, what does the suspected
malware tool do?
2. Can you identify any live memory modifications of files (look at the results of static analysis
and what you found in question 1).
3. What are the host-based indicators that this malware generates?
4. What is the purpose of this program, and what lead you to this conclusion.
Lab 3-4:
********************Make a backup copy of this file before you run it!************
1. What happens when you run the file?
2. Are there any options that you can try to keep this from happening (using the results of your
static/dynamic analysis, not additional tools)? What are they?
3. Are there other ways to run the program that might be more successful? What are these and
how did you find them?