[Hands-on] Malware, Busted! 📸 Running in a Sandbox and Capturing the Crime Scene with ProcMon (Beginning of Dynamic Analysis)

Jul 15, 2026

—

Hello, security analysts who prove with action! 🕵️‍♂️

Until last time, we mastered ‘static analysis’, where we dissected malware without actually running it. We looked at the code and predicted, “Hmm, this guy plans to steal files.”

But you can’t catch a culprit with just suspicion. Now it’s time to gather physical evidence! Today, we’ll conduct a ‘dynamic analysis’ hands-on session, where we actually run malware and record all its misdeeds within the operating system, just like a CCTV.

Let’s grab our powerful weapon, ProcMon (Process Monitor), and raid the malware’s crime scene! 🚨

🛑 0. [MUST READ] Secure an Absolutely Safe Zone!

Before we begin in earnest, we emphasize the safety rules once again.

⚠️ Warning: Never run this on your host PC (the computer you are currently using)! It must be done in a virtual machine environment like VMware or VirtualBox. Before the practice, be sure to take a ‘snapshot’ of your virtual machine. This is to cleanly revert the infected state with a single button after running the malware.

1. 🛠️ Preparations: Malware Surveillance Team Set

You will need Sysinternals Suite tools. (Free download available from Microsoft’s official website)

Process Monitor (ProcMon): A CCTV that records file, registry, and process activity in real-time.
Process Explorer (Procexp): An advanced task manager that displays currently running processes in a tree structure.
Wireshark (Optional): A tool for capturing network packets (today we focus on ProcMon).

2. 📸 [Hands-on Step 1] Starting Undercover: ProcMon Setup

Before running the malware, you must first turn on the surveillance camera (ProcMon). However, ProcMon records all Windows operations, so thousands of logs accumulate every second. ‘Filtering’ is essential!

Run ProcMon: Execute procmon.exe as an administrator.
Pause Capture: Click the magnifying glass icon (🔎) to temporarily stop capturing. (For initial setup)
Set Filter (Ctrl + L):

Filter by the malware filename.
Process Name is malware.exe (your malware filename) Include
Click the Add button -> Click OK.

Now ProcMon is ready to record only ‘its’ actions.

3. ▶️ [Hands-on Step 2] Capturing the Crime Scene: Running Malware

This is the tense moment. Finally, we press the run button.

Start ProcMon Capture: Click the magnifying glass icon (🔎) again (the X mark disappears) to start recording.
Run Process Explorer: Keep it open next to ProcMon, ready to observe the process tree.
Execute Malware!: Double-click malware.exe. 💣
Observe:

Does it look like nothing happened?
Look at the ProcMon screen. Logs will be scrolling up like crazy!
In Process Explorer, check if the malware spawns child processes (cmd.exe, powershell.exe).

Stop Execution: Let it run for about 1-2 minutes, then click the ProcMon magnifying glass icon to stop capturing.

4. 🕵️‍♀️ [Hands-on Step 3] Analyzing Evidence: Interpreting Logs

Now we need to find the ‘decisive evidence’ among the thousands of collected log lines. Let’s analyze by category using the 5 icons in ProcMon’s toolbar.

① 📂 File System Activity

Icon: Briefcase shape
Key Observation Points:
CreateFile / WriteFile: Did it create new files? (e.g., dropping C:Temppayload.exe, creating readme.txt ransomware note)
DeleteFile: Did it delete original files? (A typical characteristic of ransomware)
ReadFile: Did it read your important documents (My Documents)? (Attempt to steal information)

② ⚙️ Registry Activity

Icon: Cube shape
Key Observation Points: Attempt to achieve ‘Persistence’
Look for RegSetValue events.
If the path is HKCUSoftwareMicrosoftWindowsCurrentVersionRun?
This means the malware registered itself to run automatically even after the PC is turned off and on again! This is 100% malicious activity.

③ 🌐 Network Activity

Icon: Network cable shape
Key Observation Points:
TCP Connect / UDP Send: Did it attempt to connect to an external IP?
Record the connected IP address and port number (e.g., 4444). It’s highly likely to be a C2 server.

④ 🚀 Process and Thread Activity

Icon: Puzzle piece shape
Key Observation Points:
Process Create: If the malware executed cmd.exe and issued a /c del backup command? This is an act of deleting backups.

5. 🤖 [Pro Tip] Let AI Analyze Collected Logs

Are the logs too numerous and complex? Use AI!

Drag and select a few suspicious log lines in ProcMon and save them as CSV or copy them.
Ask AI the following:

[Prompt]

“These are malware logs collected from ProcMon. Please interpret the meaning of these events from a security perspective. Specifically, what does RegSetValue signify?”

[Paste Logs]

12:01:05, malware.exe, RegSetValue, HKCU…RunUpdate, SUCCESS, Data: C:Tempmalware.exe

AI will clearly explain: “This log indicates that the malware is self-registering in the registry under the name ‘Update’ to automatically run when Windows starts.”

🎉 Conclusion: The one that moves is the culprit!

Congratulations! 👏 You have just executed malware and meticulously recorded its ‘behavioral patterns’.

If static analysis is “drawing a composite sketch”,
Dynamic analysis is “video review of the crime scene”.

Now we have understood both the malware’s appearance (code) and its behavior (logs). The analysis is 99% complete. Next time, we will move on to the final step of organizing all these analysis results and writing a professional [Malware Analysis Report].

Don’t forget to revert your snapshot, and see you next time! Goodbye! 👋