This question aligns with CHFI v11 objectives underMalware Forensics, specificallystatic vs. dynamic malware analysisand the use ofsandboxed environments. Dynamic malware analysis involves executing a suspicious file in a controlled and isolated environment to safely observe its real-time behavior. CHFI v11 emphasizes that many modern malware samples use obfuscation, packing, or fileless techniques that conceal their functionality unless they are actually executed.
The primary objective of running malware in a sandbox is tomonitor its behavior without endangering production systems. Investigators can observe network communications (such as command-and-control traffic), file system changes, registry modifications, process injection, persistence mechanisms, and encryption activity. These behaviors provide critical indicators of compromise (IoCs) and help investigators understand the malware's capabilities, intent, and impact.
Sandboxing ensures forensic safety by isolating the malware from the host operating system and broader network, preventing unintended damage or data loss. The other options are not valid forensic objectives- performance optimization, author attribution, or storage efficiency are unrelated to dynamic malware execution. Therefore, consistent with CHFI v11 malware analysis methodology, the correct objective is to safely observe malware behavior and interactions in a controlled environment.