A Small Ghidra Workflow

• Import the sample; let auto-analysis run.
• Open Imports in the Symbol Tree; note interesting APIs (e.g. VirtualAllocEx, WriteProcessMemory).
• Double-click an API → view XREFs → jump to the calling function.
• Read the decompiler output; rename the function to what it does (e.g. inject_payload).
• Find suspicious strings; XREF them to config / C2 logic.
• Repeat outward from main / entry until the story is clear.