You are analyzing a malware sample in a debugger and notice the use of the CALL instruction followed by the manipulation of the EAX register. You suspect the malware is using custom functions for malicious purposes. How would you proceed with the analysis? (Choose three)

Question

Accepted Answer

A. Step into the CALL instruction to observe the function being executed. B. Analyze the memory and stack before and after the CALL to understand how function arguments E. Set a breakpoint after the CALL to observe the returned value in the EAX register.

Answer

C. Dump the memory to inspect the malware's unpacked payload.

Answer

D. Use static analysis tools to decompile the malware before proceeding further with dynamic

You are analyzing a malware sample in a debugger and notice the use of the CALL instruction followed by the manipulation of the EAX register. You suspect the malware is using custom functions for…

Question

Options

How the community answered

Community Discussion