After this lesson, you will be able to: Run a sample safely in an isolated VM with no network access, use x64dbg (Windows) and strace/ltrace (Linux) to observe behavior, and understand how dynamic analysis complements static analysis.
Dynamic analysis runs a sample and watches what it does. This lesson covers building a safe analysis environment, debugging with x64dbg on Windows and strace/ltrace on Linux, and what behavior to observe, always on benign samples.
Static analysis shows what code exists; dynamic analysis shows what it actually does when run, including behavior that is hidden, packed, or only triggered at runtime. You watch which files it touches, which network connections it attempts, which registry keys or processes it manipulates, and how it unpacks itself in memory. Static and dynamic analysis together give a complete picture; either alone has blind spots.
On Windows, x64dbg is the standard free debugger: set breakpoints, step through execution, inspect memory and registers, and watch a packed sample unpack itself in memory (where the real code becomes visible). On Linux, strace traces system calls (file opens, network, process actions) and ltrace traces library calls, giving a fast behavioral summary without a full debugger. These tools let you observe rather than guess.
Use a benign sample in a disposable VM.
1. In a disposable VM (snapshot taken), prepare to run the benign sample.
2. On Linux: run strace ./sample and ltrace ./sample; note the files it opens and any network or library calls.
3. On Windows: load the sample in x64dbg, set a breakpoint at the entry point, and step through key calls.
4. Compare the observed behavior to your static-analysis hypothesis from earlier lessons.
5. Revert the VM snapshot when done. Note how behavior you could not see statically becomes obvious at runtime.
Pick the best reason.
Running a sample outside isolation 'just once.' Forgetting to snapshot before execution. Giving the analysis VM network or shared folders to the host (escape and spread risk). Relying only on dynamic analysis and missing dormant code paths. Not correlating dynamic findings with the static view. Analyzing real malware without the training and infrastructure this subtrack deliberately avoids.
Sign in and purchase access to unlock this lesson.