When malware is executed, it can interact with a system in various ways and perform different activities. For example, when executed, a malware can spawn a child process, drop additional files on the filesystem, create registry keys and values for its persistence, and download other components or take commands from the command and control server. Monitoring a malware's interaction with the system and network will help in gaining a better understanding of the nature and purpose of the malware.

During dynamic analysis, when the malware is executed, you will carry out various monitoring activities. The objective is to gather real-time data related to malware behavior and its the impact on the system. The following list outlines different types of monitoring carried out during dynamic analysis:

• Process monitoring: Involves monitoring the process activity and examining the properties of the result process during malware execution.
• File system monitoring: Includes monitoring the real-time file system activity during malware execution.
• Registry monitoring: Involves monitoring the registry keys accessed/modified and registry data that is being read/written by the malicious binary.
• Network monitoring: Involves monitoring the live traffic to and from the system during malware execution.

The monitoring activities explained in the preceding points will help in gathering host and network information related to the malware's behavior. The upcoming sections will cover the practical use of these activities. In the next section, you will understand various tools that can be used to perform these monitoring activities.