The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds…

The malware analysis process progresses from automated sandbox analysis, to behavioral analysis, and then to static and dynamic code analysis to examine the specimen's code structure and runtime behavior in depth. Static analysis inspects the binary or disassembled code without execution, while dynamic analysis monitors system calls, network activity, and memory changes during controlled execution. Together these steps reveal the malware's capabilities, obfuscation techniques, and additional indicators of compromise beyond what behavioral analysis surfaces.

Unpacking and memory forensics are specialized techniques employed as part of or after static/dynamic code analysis when packing or obfuscation is detected, not as the immediate next step following behavioral analysis.

Containing the subnet is an incident response action that should have been addressed during the containment phase, not a step within the malware analysis workflow itself.

Documenting findings and cleaning up the laboratory is the final step of the malware analysis process, performed only after all analysis phases are complete.