An analyst is using Process Monitor to observe a malware sample. The analyst wants to filter the output to show only file system activity related to a specific directory. Which filter criteria should the analyst apply?

Process Name is 'malware.exe' and Operation is 'RegSetValue'.

Path is 'C:\Windows' and Operation is 'ReadFile'.

Result is 'SUCCESS' and Operation is 'TCP Connect'.

Operation is 'WriteFile' and Path contains the target directory.

During dynamic analysis, an analyst observes that the malware creates a mutex named 'Global\MyAppMutex' and then spawns a child process that runs with elevated privileges. Which two behaviors should the analyst note in the report?

Persistence mechanism and anti-debugging technique.

Process injection and code obfuscation.

Network beaconing and data exfiltration.

Mutex creation for single-instance enforcement and privilege escalation.

What is the primary function of Regshot in dynamic malware analysis?

To list running processes and their parent-child relationships

To analyze the malware's binary code

To monitor network traffic in real time

To take a snapshot of the registry before and after execution and compare the differences

What is an anti-analysis technique that malware might use to hinder dynamic analysis?

Opening a network connection to a well-known website

Detecting if it is running inside a virtual machine and refusing to execute

Creating a large number of files in the temporary directory

Using a valid code-signing certificate

An analyst has completed dynamic analysis of a keylogger and needs to document the findings. Which section should be included in the report to describe the malware's behavior in a structured way?

The exact time the analyst started the analysis

Behavioral observations, including file, registry, process, and network activities

The analyst's personal notes about the malware's code quality

A list of all tools installed on the analysis VM

EC-CouncilDigital Forensics Essentials

Domain 7Objective 4

Dynamic Malware Analysis DFE Practice Questions (Page 9)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 41–45

41application · medium
An analyst is using Process Monitor to observe a malware sample. The analyst wants to filter the output to show only file system activity related to a specific directory. Which filter criteria should the analyst apply?
Select an answer first
42application · medium
During dynamic analysis, an analyst observes that the malware creates a mutex named 'Global\MyAppMutex' and then spawns a child process that runs with elevated privileges. Which two behaviors should the analyst note in the report?
Select an answer first
43foundation · easy
What is the primary function of Regshot in dynamic malware analysis?
Select an answer first
44foundation · easy
What is an anti-analysis technique that malware might use to hinder dynamic analysis?
Select an answer first
45application · medium
An analyst has completed dynamic analysis of a keylogger and needs to document the findings. Which section should be included in the report to describe the malware's behavior in a structured way?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.