A malware analyst is asked to analyze a suspicious document that is believed to contain a macro that downloads a payload. The analyst wants to observe the macro's behavior without infecting the production network. Which approach should the analyst take?

Open the document on a production workstation with macros enabled and observe the behavior.

Open the document in a virtual machine with host-only networking and monitor process, file, and network activity.

Disable macros and open the document in a sandbox.

Use a static analysis tool to extract the macro code without executing it.

An analyst is analyzing a sample that is suspected of injecting code into a legitimate system process. The analyst has Process Monitor and Process Explorer. Which observation would most strongly indicate process injection?

The malware opens a network connection to a remote server.

A legitimate process, such as svchost.exe, suddenly allocates memory with write and execute permissions and creates a remote thread.

The malware writes to the registry Run key.

The malware creates a new process with a random name.

During dynamic analysis of a trojan, an analyst observes that the malware creates a new service named 'WindowsUpdateSvc' and modifies the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Which tool combination would best document these changes for a report?

Process Explorer to view running processes, and TCPView to monitor network connections.

Regshot to capture registry before and after, and Process Monitor to log service creation and registry writes.

Process Monitor to log file and registry activity, and a manual screenshot of the registry editor.

Wireshark to capture network traffic, and Regshot to compare registry snapshots.

Which activity is a key part of dynamic malware analysis?

Disassembling the binary to understand its control flow

Running the malware in a sandbox to observe its interactions with the system

Searching for strings in the binary to find URLs or IP addresses

Reviewing the malware's import table to list external functions

EC-CouncilDigital Forensics Essentials

Domain 7Objective 4

Dynamic Malware Analysis DFE Practice Questions (Page 6)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 26–30

26application · medium
A malware analyst is asked to analyze a suspicious document that is believed to contain a macro that downloads a payload. The analyst wants to observe the macro's behavior without infecting the production network. Which approach should the analyst take?
Select an answer first
27expert · hard
An analyst is analyzing a sample that is suspected of injecting code into a legitimate system process. The analyst has Process Monitor and Process Explorer. Which observation would most strongly indicate process injection?
Select an answer first
28application · medium
During dynamic analysis of a trojan, an analyst observes that the malware creates a new service named 'WindowsUpdateSvc' and modifies the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Which tool combination would best document these changes for a report?
Select an answer first
29foundation · easy
Which tool is specifically designed to monitor registry and file system changes in real time during malware execution?
Select an answer first
30foundation · easy
Which activity is a key part of dynamic malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.