Exam 350-201 topic 1 question 109 discussion

A. Perform static and dynamic code analysis of the specimen.

Following behavioral analysis in a controlled laboratory, the next step in the malware analysis process is to perform static and dynamic code analysis of the specimen. Static analysis involves examining the malware without executing it, while dynamic analysis involves observing the malware's behavior in a controlled environment. These analyses provide deeper insights into the malware's capabilities and intentions2.

B. A is for software developers to identify vulnerabilites. Memory forensics is required.

The next step in the malware analysis process would be to perform static and dynamic code analysis of the specimen. After performing behavioral analysis, static analysis involves examining the code and characteristics of the malware to identify any recognizable patterns or signatures, while dynamic analysis involves observing the behavior of the malware in a controlled environment to understand its methods of attack and any associated network communications. These steps help in developing countermeasures and detection methods for similar types of malware. - ChatGPT

A. Perform static and dynamic code analysis of the specimen.

https://www.sans.org/blog/3-phases-of-malware-analysis-behavioral-code-and-memory-forensics/ Memory analysis examines memory of the infected system to extract artifacts relevant to the malicious program. In the context of reverse-engineering malware, memory analysis can help identify malicious code that is trying to hide itself (i.e., rootkits), can clarify the program's run-time dependencies, and can explain how the specimen was used on the victim's system. Memory analysis saves time and allows the investigator to take shortcuts when studying the specimen's behavior or code.

https://sansorg.egnyte.com/dl/oZleNgF6uF A would be the next step :)

The static and dynamic analysis was already done. the question is the next step for the behavioral analysis I'll go with the answer B for memory forensic.