Process and analysis
What is Dynamic analysis?
Running a suspicious file in a controlled environment and watching what it actually does: processes, files, registry and network activity.
Dynamic analysis runs a sample in a controlled, isolated environment, such as a sandbox or analysis VM, and records its behaviour: processes started, files and registry keys changed, network connections made and data sent.
It shows what the malware really does, including unpacked payloads and C2 addresses. Some samples detect analysis environments or wait before acting, so analysts combine it with static analysis and adjust the environment to look like a real machine.