# Dynamic Analysis

> Master dynamic malware analysis. Learn to safely execute malware in an isolated sandbox, monitor behavior with Procmon and Wireshark, and extract behavioral IOCs.

Canonical: https://codelivly.com/rooms/dynamic-analysis
Last updated: 2026-09-16

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module transitions from examining code at rest to observing it in action. You will learn how to safely detonate malware in an isolated, instrumented virtual machine. By utilizing industry-standard behavioral monitoring tools like Process Monitor (Procmon), Wireshark, and Sysmon, you will capture real-time file system changes, registry modifications, process injections, and network communications. Mastering dynamic analysis allows defenders to bypass static obfuscation, understand the malware's true execution flow, and extract critical behavioral Indicators of Compromise (IOCs) that static analysis cannot reveal.

## Lessons

1. What Is Dynamic Analysis and Why Does It Matter (30 min)
2. Monitoring Process, File & Registry Behavior (30 min)
3. Analyzing Network Behavior of Malware (30 min)
4. Guided Lab: Dynamic Analysis in a Sandbox (30 min)

## Related

- [Learning path: Malware Analysis Fundamentals](https://codelivly.com/learning-paths/malware-analysis-fundamentals)
- [All rooms](https://codelivly.com/rooms)