Which analysis method involves executing the malware to observe its behavior on the host system?

Which analysis method involves executing the malware to observe its behavior on the host system?

• A. Static Malware Analysis
• B. Dynamic Malware Analysis
• C. Registry/configuration tools
• D. Log analyzers

Answer: (B)

Observing runtime behavior by executing the sample in a controlled environment is dynamic malware analysis. This approach runs the malware and watches what it does on the host—file system changes, registry keys modified, processes started, network connections made, and any persistence mechanisms it tries to establish. Because you see actions as they happen, you can uncover behaviors that static analysis might miss, such as unpacking payloads at runtime or anti-analysis techniques. Static malware analysis, by contrast, examines the code without execution, looking for signatures, strings, and control flow to infer capabilities. The other options refer to tools or methods that aren’t about watching live behavior during execution. Dynamic analysis requires a sandbox or isolated VM with monitoring to keep systems safe while capturing observable actions.

Observing runtime behavior by executing the sample in a controlled environment is dynamic malware analysis. This approach runs the malware and watches what it does on the host—file system changes, registry keys modified, processes started, network connections made, and any persistence mechanisms it tries to establish. Because you see actions as they happen, you can uncover behaviors that static analysis might miss, such as unpacking payloads at runtime or anti-analysis techniques. Static malware analysis, by contrast, examines the code without execution, looking for signatures, strings, and control flow to infer capabilities. The other options refer to tools or methods that aren’t about watching live behavior during execution. Dynamic analysis requires a sandbox or isolated VM with monitoring to keep systems safe while capturing observable actions.