Perform Dynamic Malware Analysis

---
name: perform-dynamic-malware-analysis
description: Observe suspicious content in a disposable environment. Use when execution, process ancestry, file changes, persistence, network behavior, payloads, or user interaction need measurement after static analysis with isolation and teardown.
---

# Perform Dynamic Malware Analysis

## Overview

Execute only inside an environment chosen by `select-analysis-isolation` and preflighted by `prepare-isolated-analysis-lab`, with an observation plan that can distinguish artifact behavior from baseline noise. Preserve the exact sample, prepared-lab record, and environment identity.

Read [references/dynamic-observation-plan.md](references/dynamic-observation-plan.md) for baseline, stimulus, telemetry, and teardown fields.

## Workflow

1. Define the unresolved question and minimum stimulus.
2. Verify isolation.
   - Require the prepared-lab record and verify its guest/platform build, baseline/reset state, accounts, shares, clipboard, devices, credentials, network mode, monitoring, stop controls, export path, and teardown plan are still current.
   - Record virtualization artifacts or anti-VM behavior that may affect the conclusion.
3. Capture a baseline.
   - Record processes, files/registrations, persistence surfaces, network state, services, and relevant logs before execution.
4. Execute one controlled step.
   - Record command/UI action, time, user/privilege, environment variables, arguments, and interactions.
   - Do not improvise additional payloads, credentials, or targets.
5. Observe behavior.
   - Correlate process tree, file/registry or platform state, persistence, permissions, child artifacts, network/DNS, logs, prompts, crashes, and timing.
   - Hash and preserve dropped/modified artifacts as new evidence.
6. Repeat only to answer a named question.
   - Change one variable at a time and revert to the baseline snapshot.
7. Export and tear down.
   - Export only intended evidence, scan it before host use, destroy/revert the environment, and revoke temporary access.

## Output

Return the prepared-lab identity, environment/baseline identity, stimulus, observed timeline, artifacts and indicators, absent expected behavior, virtualization/evasion/coverage limits, conclusion, and teardown verification.