# Malware Analysis Basics **URL:** \ **Category:** Content Discussion\ **Created:** [August 28, 2024, 6:52am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763 "2024-08-28T06:52:54Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![SmoggyFalcon6341](https://forums.cybrary.it/user_avatar/forums.cybrary.it/smoggyfalcon6341/32/11_2.png) [@SmoggyFalcon6341](https://forums.cybrary.it/u/SmoggyFalcon6341)\ **Post date:** [August 28, 2024, 6:52am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/1 "2024-08-28T06:52:55Z")
Not exactly sure how to answer question 2 of the Guided Exercise for the “Malware Analysis Basics” course. I tried the Hex values at the location, I tried converting values separated by null bytes into decimal values, etc. Any idea what is expected or how to arrive at the correct answer? #### What is the first 8-digit value that appears in the assembly code for the killRDP function when examined in Ghidra’s Code Browser? ---
**Author:** ![JosephWhite](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josephwhite/32/2407_2.png) [@JosephWhite](https://forums.cybrary.it/u/JosephWhite)\ **Post date:** [August 28, 2024, 1:53pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/2 "2024-08-28T13:53:59Z")
The question is asking for the **memory address** of the start of the killrbp function decompiled in Ghidra. ![image](https://forums.cybrary.it/uploads/default/original/3X/2/7/276d6615d5a4ed0886c660c73699fa11ea3ab2f0.png) ---
**Author:** ![AutomaticBird3902](https://forums.cybrary.it/user_avatar/forums.cybrary.it/automaticbird3902/32/11_2.png) [@AutomaticBird3902](https://forums.cybrary.it/u/AutomaticBird3902)\ **Post date:** [November 3, 2024, 9:55am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/3 "2024-11-03T09:55:41Z")
I have a problem looking for the first IP address in “Sample 1”, I have done all the procedures but I can’t see the sample in the list of each process. Can you help, I need badly help on this. Thank you ---
**Author:** ![JosephWhite](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josephwhite/32/2407_2.png) [@JosephWhite](https://forums.cybrary.it/u/JosephWhite)\ **Post date:** [November 3, 2024, 5:33pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/4 "2024-11-03T17:33:42Z")
![image](https://forums.cybrary.it/uploads/default/original/3X/4/7/47029f60cf5d2320ca0a41aa9089ff4017bb1e55.png) ---
**Author:** ![Disgurlizfly39867](https://forums.cybrary.it/user_avatar/forums.cybrary.it/disgurlizfly39867/32/11_2.png) [@Disgurlizfly39867](https://forums.cybrary.it/u/Disgurlizfly39867)\ **Post date:** [December 13, 2024, 12:03am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/6 "2024-12-13T00:03:19Z")
Hello I’m having an issue with a step in Malware Analysis Basics. I’m not sure if this step is flawed. “4. In the Process Monitor, click the red trash can icon to clear the Process Monitor, then immediately double-click the malicious sample1.exe file to detonate the malware.” I’ve attempted this step numerous times on the past 2 hours and I’m unable to locate. Is it a path I’m missing or is this step flawed? ![Malware Analysis Basics3](https://forums.cybrary.it/uploads/default/original/3X/d/c/dc3d646a166b4e42bb3b7c8387229b5c2e5b9b57.png) ---
**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\ **Post date:** [December 13, 2024, 3:28am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/7 "2024-12-13T03:28:21Z")
Hey there - to clarify, that’s the malicious sample1.exe file on the Windows desktop. Are you launching that file from the desktop, or clicking on something within the Process Explorer to generate that error message? ---
**Author:** ![JosephWhite](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josephwhite/32/2407_2.png) [@JosephWhite](https://forums.cybrary.it/u/JosephWhite)\ **Post date:** [December 13, 2024, 4:53am UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/8 "2024-12-13T04:53:33Z")
![image](https://forums.cybrary.it/uploads/default/original/3X/3/d/3ddcc9291c1b668ecec45cc887684047dcbe6ae4.png) I think it should just say **sample1.exe** , as this is the same file you have been working with the rest of the lab. I think “malicious” is just a description and should not be bold 🙂 ---
**Author:** ![Disgurlizfly39867](https://forums.cybrary.it/user_avatar/forums.cybrary.it/disgurlizfly39867/32/11_2.png) [@Disgurlizfly39867](https://forums.cybrary.it/u/Disgurlizfly39867)\ **Post date:** [December 15, 2024, 11:39pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/9 "2024-12-15T23:39:35Z")
I found it thank you all. I miss read the location. I was looking in the tool for it. And not clicking and dragging on the file from “desktop” to the tool. ---
**Author:** ![MixedKrill2604](https://forums.cybrary.it/user_avatar/forums.cybrary.it/mixedkrill2604/32/11_2.png) [@MixedKrill2604](https://forums.cybrary.it/u/MixedKrill2604)\ **Post date:** [July 6, 2025, 4:00pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/10 "2025-07-06T16:00:02Z")
Can you please let us know the first IP address that the sample1.exe malware attempted to connect to? I tried everything possible but not but unable to get the graph. ---
**Author:** ![MixedKrill2604](https://forums.cybrary.it/user_avatar/forums.cybrary.it/mixedkrill2604/32/11_2.png) [@MixedKrill2604](https://forums.cybrary.it/u/MixedKrill2604)\ **Post date:** [July 6, 2025, 4:01pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/11 "2025-07-06T16:01:03Z")
Can you please let us know the first IP address that the sample1.exe malware attempted to connect to? I tried everything possible but not but unable to get the graph. ---
**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\ **Post date:** [July 7, 2025, 3:51pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/12 "2025-07-07T15:51:39Z")
Could you please provide a screenshot of what you’re seeing? ---
**Author:** ![MixedKrill2604](https://forums.cybrary.it/user_avatar/forums.cybrary.it/mixedkrill2604/32/11_2.png) [@MixedKrill2604](https://forums.cybrary.it/u/MixedKrill2604)\ **Post date:** [July 10, 2025, 12:54pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/13 "2025-07-10T12:54:10Z")
I am not getting this graph and hence unable answer the question which asks for the IP address. Please let me know if you know the answer. ![image](https://forums.cybrary.it/uploads/default/original/3X/7/0/702c7ef31718da4575df1a4365f226a0570d66ad.png) ---
**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\ **Post date:** [July 10, 2025, 1:49pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/14 "2025-07-10T13:49:04Z")
I know the answer, but posting it here would defeat the purpose of the lab 😉 I can confirm that this lab works as expected as long as you’re following all of the steps correctly. If you’re not seeing the graph, it means you’ve likely missed a step somewhere. Could you please provide screenshots at the following steps? -Part 2, Step 8 [confirming successful malware detonation] -Part 2, Step 17 [confirming successful refresh of procdot with correct log file and process selected in the Monitoring Logs and Render Configuration fields] ---
**Author:** ![JohnPwC](https://forums.cybrary.it/user_avatar/forums.cybrary.it/johnpwc/32/11_2.png) [@JohnPwC](https://forums.cybrary.it/u/JohnPwC)\ **Post date:** [December 22, 2025, 7:20pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/15 "2025-12-22T19:20:11Z")
I am unable to get the sample1.exe” process to terminate. As a result, the csv files shows that it will take 6 hours to complete. When I try to terminate and then confirm the termination it gives an error message that it cannot be terminated. The process pops up then disappears. how to complete the lab? this is a walkthrough and should not be this difficult. ---
**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\ **Post date:** [December 22, 2025, 7:52pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/16 "2025-12-22T19:52:26Z")
I was able to replicate. I’ve run this lab probably dozens of times in the past few years, and it seems like something has changed in the behavior of the malware, where it intermittently appears and disappears in the Process Hacker view. I’ll flag this to the instructor. ---
**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\ **Post date:** [December 22, 2025, 7:54pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/17 "2025-12-22T19:54:41Z")
Actually, I was able to grab and terminate the process on my most recent attempt, but something still seems to have changed recently. ---
**Author:** ![JosephWhite](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josephwhite/32/2407_2.png) [@JosephWhite](https://forums.cybrary.it/u/JosephWhite)\ **Post date:** [December 23, 2025, 4:24pm UTC](https://forums.cybrary.it/t/malware-analysis-basics/251763/18 "2025-12-23T16:24:20Z")
The malware sample can no longer reach an Internet resource it needs, so it kills itself and then respawns to try again. I have updated (and simplified) the lab steps to reflect this new behavior.