Summary

• Dynamic analysis observes real behavior and beats packing — but demands strict isolation.
• Safe lab = isolated network, snapshots, no shared folders/clipboard, fake internet, revert every run.
• Tools: Procmon, Regshot, Autoruns, Process Hacker, FakeNet-NG / INetSim, Wireshark.
• Map behavior to MITRE ATT&CK; collect concrete artifacts per tactic.
• Automated sandboxes scale but face evasion — know the anti-analysis arms race.
• Turn observations into scored heuristics and IOCs (Lab 4).