Unit 2: Dynamic Analysis and Assembly Language - Practice Quiz

1 What is the main purpose of dynamic malware analysis?

2 Where should suspected malware normally be executed for dynamic analysis?

3 Which malware behavior can be observed using a process-monitoring tool?

4 Why is a baseline snapshot recorded before executing malware?

5 What does DLL stand for in Windows?

6 Which Windows utility is commonly used to manually load and execute an exported DLL function?

7 What is assembly language?

8 What is an assembly instruction mnemonic?

9 What is a processor register?

10 Which x86 register commonly holds the current stack pointer?

11 Which assembly instruction is commonly used to copy data from a source to a destination?

12 What does the instruction PUSH EAX normally do?

13 Which instruction adds a source operand to a destination operand?

14 If EAX contains , what value will it contain after INC EAX?

15 Which bitwise instruction is commonly used to clear selected bits with a mask?

16 What is the result of applying XOR to a value with itself?

17 Which instruction performs an unconditional branch to another location?

18 Which instruction is commonly used to invoke an assembly function?

19 How are elements of a basic array usually stored in memory?

20 How are individual fields commonly accessed within a structure in assembly language?

21 Which sequence is most appropriate when dynamically analysing an unknown malware sample in a virtual machine?

22 A malware sample exits because it cannot contact its command-and-control server. Which laboratory adjustment best supports further dynamic analysis?

23 A monitored process calls VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread on another process. What behaviour does this sequence most strongly indicate?

24 Which comparison would most directly reveal that a malware sample established persistence during execution?

25 A suspicious DLL exports a function named StartW. Which command is commonly used to invoke that export for controlled analysis?

26 A DLL performs extensive network communication inside DllMain and frequently deadlocks when loaded. What is the best corrective design?

27 In Intel syntax, what does mov eax, [ebx+4] do?

28 In x86-64 mode, RAX initially contains 0xFFFFFFFFFFFFFFFF. What is its value after mov eax, 1?

29 What is the effect of lea eax, [ebx+ecx*4]?

30 Given EAX = 10 and EBX = 3, what is the final value of EAX after the following instructions?

sub eax, ebx

imul eax, 2

31 An 8-bit register contains AL = 0x7F. After add al, 1, which result and flag combination is correct?

32 Which instruction clears bits 4 through 7 of EAX while preserving all other bits?

33 After cmp eax, ebx, which jump instruction branches when EAX is greater than EBX under a signed comparison?

34 Suppose EAX = 0xFFFFFFFF and EBX = 1. What happens after cmp eax, ebx followed by ja target?

35 What is the final value of EAX after this loop executes?

mov eax, 0

mov ecx, 4

L1: add eax, ecx

loop L1

36 Under the Windows x64 calling convention, a function modifies RBX and then calls another function. What should it do before returning to its caller?

37 A row-major array int a[3][5] begins at address 0x1000, and each integer occupies 4 bytes. What is the address of a[2][3]?

38 With the direction flag cleared, RDI pointing to a null-terminated string, AL = 0, and a sufficient RCX, what does repne scasb do when it finds the null byte?

39 Assuming standard natural alignment, what is the size of the following structure?

struct Item { char tag; int count; short code; };

40 An x64 instruction is mov eax, [rip+0x20]. If RIP for the next instruction is 0x1007, which memory address is read?

41 A malware sample contacts a domain, sleeps for ten minutes, and creates persistence only if both checks succeed. Which experimental design best determines whether the DNS response and elapsed time are independent activation gates?

42 A sample creates a registry key, reads it from a child process, and deletes it before termination. A before-and-after registry comparison shows no change. Which addition most directly captures this transient behavior?

43 A process starts a legitimate executable in a suspended state, calls NtUnmapViewOfSection, writes a replacement image into the target, changes the initial thread context, and resumes it. Which technique is most specifically indicated?

44 A suspicious DLL exposes only export ordinal 17. The function expects two pointers and returns an integer, rather than using the callback prototype expected by rundll32.exe. What is the safest reliable way to execute the export dynamically?

45 A DLL's DllMain creates a worker thread during DLL_PROCESS_ATTACH and waits for that thread to signal completion. The worker never reaches its entry routine, and the loading thread hangs. What best explains and fixes the problem?

46 Memory at address buf contains the bytes 78 56 34 12. On a little-endian x86-64 system, what is the final value of EAX after mov eax, dword ptr [buf] followed by bswap eax?

47 Which x86-64 instruction cannot be encoded because accessing one operand requires a REX prefix while accessing the other forbids a REX prefix?

48 Assume RAX = 0xAAAAAAAAAAAAAAAA. What is RAX after executing mov eax, 0xFFFFFFFF in 64-bit mode?

49 Memory at [RDI] contains the 16-bit value 0xFF80. What is RAX after movsx eax, word ptr [rdi]?

50 Suppose RDI = 0xFFFFFFFFFFFFFFF0 and RSI = 4. What does lea rax, [rdi+rsi*4+8] do?

51 Before idiv rcx, the registers contain RDX = 0, RAX = 0xFFFFFFFFFFFFFFFF, and RCX = 1. What happens?

52 Given RDX = 5 and RAX = 0xFFFFFFFFFFFFFFFF, what are the values after add rax, 1 followed by adc rdx, 0?

53 If EAX = 0x80000000, which flag state follows test eax, eax?

54 Let AL = 0x81. After rol al, 1, what are AL, CF, and OF?

55 Assume EAX = 0xFFFFFFFF and EBX = 1. After cmp eax, ebx, how do jl and jb behave?

56 Immediately before loop target, RCX = 1 and ZF = 1. What happens when the instruction executes?

57 Under the Windows x64 ABI, a function begins with $RSP \bmod 16 = 8$ and needs to call another function without local variables. Which sequence correctly supplies shadow space and call-site alignment?

58 A routine must copy 16 bytes from src to dst = src + 2 using rep movsb without corrupting overlapping data. Which setup implements the required backward copy?

59 Under a typical x64 C ABI with natural alignment, consider struct S { char tag; uint32_t count; uint16_t code; void *next; };. Which layout is correct?

60 At virtual address 0x1000, the six-byte instruction mov eax, dword ptr [rip+0x20] executes. From which virtual address is the four-byte value loaded?