Describe a basic malware dynamic analysis approach in a sandbox.

• A. Run in isolated VM; monitor runtime behavior: processes, network traffic, file changes, registry, API calls; collect IOCs; capture screenshots.
• B. Run on a shared production system.
• C. Only monitor network traffic.
• D. Ignore registry changes.

Answer: (D)

Dynamic malware analysis in a sandbox relies on executing the sample in an isolated virtual environment and watching its behavior in real time. The approach tracks comprehensive runtime activity: the processes the sample starts, the network connections and DNS lookups it makes, changes to the file system, modifications to the registry, and the API calls it invokes. By collecting indicators of compromise and artifacts such as new files, registry keys, mutexes, domain or IP contacts, and by capturing screenshots, you build a detailed behavior profile while containment prevents any spread or damage. The other options fall short: running on a shared production system risks impacting real users and data; monitoring only network traffic misses local file and registry changes and API behavior; ignoring registry changes misses important persistence and configuration actions.