A SOC analyst gets the alert mid-shift: EDR flagged an unsigned .exe sitting in C:\Users\Public, didn't auto-block it, just raised a ticket. Leadership wants to know in the next twenty minutes whether it's actually malware and, if so, what it does before anyone decides whether to isolate the host. Under that kind of clock, the tempting move is to just run the thing, drop it in a free online sandbox or double-click it on a spare laptop still sitting on the corporate VLAN, and watch what happens. That's not analysis, that's how a triage ticket turns into an actual incident.
The real first move never executes the file at all. Read the PE header: machine type, section names, section entropy if something looks packed. Then the import table, which is the fastest capability check that exists, because Windows binaries have to declare which APIs they call before they call them. WinInet, WinHTTP or Ws2_32 in the imports means network capability. Advapi32 alongside crypto APIs is the shape of a lot of ransomware. CreateRemoteThread and WriteProcessMemory together are the shape of process injection. None of that requires the file to run even once, and it takes minutes, not the twenty spent guessing.
When the import table comes back thin, a handful of generic calls, or the sections read as high-entropy and packed, that's the signal to go further into static disassembly before considering execution at all. Ghidra or IDA Pro turn the machine code into readable assembly, and tracing control flow at that level often answers the capability question on its own, no execution required, no risk taken.
Dynamic analysis only comes after that groundwork, and it never means double-click and watch. It means a snapshotted VM with no route to the production network, instrumented before the sample ever runs: Sysmon and Procmon capturing every file write, registry key and spawned process, a debugger with breakpoints already set on whatever calls the static pass flagged, ready to step past anti-debugging tricks and dump a payload straight out of memory if the sample tries to stay encrypted until runtime. API call monitoring closes the loop, confirming at execution time that the capability the import table hinted at is the capability actually exercised.
Static before dynamic, read the file before you ever let it run, is the entire difference between an analysis and an accident. It's also not something most people improvise correctly the first time they try it under a real deadline.
The Static and Dynamic Malware Analysis Guide builds exactly that workflow chapter by chapter, PE headers through a working isolated lab, so it's already muscle memory before the next alert fires, not something you're learning live at minute one of a twenty-minute clock: https://resources.codelivly.com/product/practical-malware-analysis-guide/
