GIAC
GREM · Question #186
You are performing behavioral analysis on a malware sample that makes unusual DNS queries and writes data to a specific registry key. Which actions should you take to further investigate this…
The correct answer is A. Capture the DNS traffic using a network sniffer tool B. Monitor registry changes using a tool like Procmon E. Reboot the system and observe if the malware starts again. See the full explanation below for the reasoning.
Question
You are performing behavioral analysis on a malware sample that makes unusual DNS queries and writes data to a specific registry key. Which actions should you take to further investigate this sample's behavior? (Choose three)
Options
- ACapture the DNS traffic using a network sniffer tool
- BMonitor registry changes using a tool like Procmon
- CDebug the malware to locate its API calls
- DIsolate the system and run the malware with network access disabled
- EReboot the system and observe if the malware starts again
How the community answered
(45 responses)- A78% (35)
- C16% (7)
- D7% (3)
Community Discussion
No community discussion yet for this question.