The Analysis Workflow
- Boot clean VM snapshot.
- Start monitoring tools (Procmon, Regshot baseline, FakeNet-NG, Wireshark).
- Detonate the sample.
- Let it run for a bounded time; interact if needed.
- Stop capture; collect logs, diffs, PCAP.
- Analyze artifacts -> map to behavior -> extract IOCs.
- Revert snapshot before the next run.
Key Takeaway
One run, one snapshot revert. A dirty VM produces dirty, untrustworthy results.