System Monitoring Tools for Dynamic Malware Analysis
A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?
Quick Answer
The answer is Process Explorer, Process Monitor, and Regshot, as these are the three tools commonly used for monitoring system changes during malware execution. Process Explorer provides deep visibility into running processes, handles, and DLLs, while Process Monitor captures real-time file system, registry, and process/thread activity using kernel-mode drivers to log operations like CreateFile and RegSetValue. Regshot takes snapshots of the registry and file system before and after execution, allowing analysts to compare changes directly. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to select the correct trio from a list that often includes traps like Wireshark or Netcat, which focus on network traffic rather than system-level changes. A useful memory tip is to think of the acronym PER: Process Explorer, Process Monitor, and Regshot—the three pillars of dynamic system change analysis.
⚠ Common exam trap
EC-Council often tests the distinction between static and dynamic analysis tools, so the trap here is that candidates confuse tools like Ghidra or PEiD (static) with runtime monitoring tools like Process Monitor or Regshot (dynamic).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process Monitor
Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Process Monitor
Why this is correct
Captures registry, file system, and process activity in real time.
- ✗
Ghidra
Why it's wrong here
Ghidra is a static reverse engineering framework, not typically used for runtime monitoring.
- ✗
PEiD
Why it's wrong here
PEiD identifies packers, cryptors, and compilers via signature scanning of static PE headers, not runtime system monitoring. It is tempting because analysts often use it during initial static analysis to detect obfuscation before execution. However, dynamic analysis requires tools like Process Monitor or API monitor that log registry, file, and process changes in real time—PEiD never executes the sample and captures no behavioural data.
- ✓
Regshot
Why this is correct
Takes before-and-after snapshots of the registry for comparison.
- ✓
Process Explorer
Why this is correct
Advanced task manager showing processes, handles, and DLLs.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?
medium- A.Wireshark
- ✓ B.Process Monitor
- C.Regshot
- D.Process Explorer
Why B: Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.