What Is Dynamic Analysis?

• Dynamic analysis: run the sample and observe what it actually does at runtime — files, registry, processes, network.
• Contrast with static analysis (last class): read the code without executing it.
• Static tells you what the malware can do; dynamic tells you what it does do on a real system.
• Cuts through packing, obfuscation, and encryption — the code must unpack itself in memory to run.