Malware Analysis

التحليل الديناميكي ومراقبة العمليات الحية باستخدام Process Hacker و Procmon

masa program

Last update :

🔬

المحاور التقنية وخطوات الفحص

🔹 مراقبة شجرة العمليات والخدمات (Process Tree)

تتبع العمليات الفرعية المنبثقة (Child Processes) ورصد استدعاء cmd.exe أو powershell.exe أو conhost.exe المشبوه.

🔹 تصفية وفلترة الأحداث في Process Monitor (Procmon)

استخدام الفلاتر المتقدمة لحصر الأحداث الخاصة بالـ Process Name واستبعاد نشاطات ويندوز الاعتيادية.

🔹 رصد عمليات إنشاء وتعديل الملفات والمفاتيح

متابعة مسارات التشغيل التلقائي (Autorun keys) ومجلدات بدء التشغيل (Startup Folders) والملفات المؤقتة %TEMP%.

💡 نصيحة وأداة المحلل الجنائي: قم بتعطيل Auto-Scroll في Procmon فور تشغيل العينة، واستخدم خيار 'Drop Filtered Events' لحفظ مساحة الذاكرة.

⚠️ تحذير وإجراءات الأمان في المختبر:

يجب دائماً تنفيذ العينات الحية داخل بيئة معزولة تماماً (Isolated Sandbox) غير متصلة بالشبكة الحقيقية، والتأكد من أخذ لقطات نظيفة (Clean Snapshots) قبل بدء الاختبار.

📌 أفضل الممارسات والتوصيات العملية:

التدرج المنطقي: ابدأ دائماً بالتحليل الساكن الأولي قبل تشغيل العينة ديناميكياً لتوفير الوقت وتجنب الفخاخ.
توثيق مؤشرات الاختراق (IoCs) وحساب الهاشات (MD5, SHA256, Imphash) في كل خطوة.
صياغة قواعد YARA وقواعد الكشف ومشاركتها مع فريق الاستجابة للحوادث (IR) لتعزيز الحماية الاستباقية.

Edit This Article

Tags Malware Analysis الأمن السيبراني الهندسة العكسية تحليل البرمجيات الخبيثة

window['__wavt'] = 'ACvIOeDfNibAnZ0CWmT3k3i49l81:1787624278966';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4702789384463124685','//www.xrefs0.com/2026/08/process-hacker-procmon.html','4702789384463124685'); _WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4702789384463124685', 'title': 'xrefs0', 'url': 'https://www.xrefs0.com/2026/08/process-hacker-procmon.html', 'canonicalUrl': 'https://www.xrefs0.com/2026/08/process-hacker-procmon.html', 'homepageUrl': 'https://www.xrefs0.com/', 'searchUrl': 'https://www.xrefs0.com/search', 'canonicalHomepageUrl': 'https://www.xrefs0.com/', 'blogspotFaviconUrl': 'https://www.xrefs0.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22xrefs0 - Atom\x22 href\x3d\x22https://www.xrefs0.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22xrefs0 - RSS\x22 href\x3d\x22https://www.xrefs0.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22xrefs0 - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4702789384463124685/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22xrefs0 - Atom\x22 href\x3d\x22https://www.xrefs0.com/feeds/9192776043197913210/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/b3457b0657156b4f', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '9192776043197913210', 'pageName': '\u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a \u0648\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062d\u064a\u0629 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Process Hacker \u0648 Procmon', 'pageTitle': 'xrefs0: \u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a \u0648\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062d\u064a\u0629 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Process Hacker \u0648 Procmon', 'metaDescription': ''}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': '\u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a \u0648\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062d\u064a\u0629 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Process Hacker \u0648 Procmon', 'description': '', 'url': 'https://www.xrefs0.com/2026/08/process-hacker-procmon.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 9192776043197913210}}, {'name': 'widgets', 'data': [{'title': 'Main menu Mopile Logo', 'type': 'Image', 'sectionId': 'MopileMenuLogo', 'id': 'Image002'}, {'title': 'xrefs0 (Header)', 'type': 'Header', 'sectionId': 'logo', 'id': 'Header1'}, {'title': 'Pages', 'type': 'PageList', 'sectionId': 'pages', 'id': 'PageList1'}, {'title': 'Social Media icons', 'type': 'LinkList', 'sectionId': 'topsocialL', 'id': 'LinkList3'}, {'title': 'Main Menu', 'type': 'LinkList', 'sectionId': 'menu', 'id': 'LinkList001'}, {'title': 'search ...', 'type': 'BlogSearch', 'sectionId': 'searchform', 'id': 'BlogSearch2'}, {'title': 'table of contents feature', 'type': 'HTML', 'sectionId': 'AddOns', 'id': 'HTML1'}, {'title': 'contact form', 'type': 'ContactForm', 'sectionId': 'AddOns', 'id': 'ContactForm200'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'Tempnec', 'id': 'Blog1', 'posts': [{'id': '9192776043197913210', 'title': '\u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a \u0648\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062d\u064a\u0629 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Process Hacker \u0648 Procmon', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': '-'}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'icons', 'label': ''}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': '-'}, {'name': 'icons', 'label': ''}, {'name': 'labels', 'label': ''}]}, {'title': '\u062a\u0627\u0628\u0639\u0646\u0627 \u0639\u0644\u0649 \u0627\u0644\u0645\u0646\u0635\u0627\u062a', 'type': 'LinkList', 'sectionId': 'sidepar', 'id': 'LinkList4'}, {'title': '\u0627\u0644\u0645\u0634\u0627\u0631\u0643\u0627\u062a \u0627\u0644\u0634\u0627\u0626\u0639\u0629', 'type': 'PopularPosts', 'sectionId': 'sidepar', 'id': 'PopularPosts1', 'posts': [{'title': '\u062a\u0642\u0646\u064a\u0627\u062a \u0643\u0634\u0641 \u0627\u0644\u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0648\u0635\u0646\u0627\u062f\u064a\u0642 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 Anti-VM \x26 Anti-Sandbox', 'id': 6232256669826110021}, {'title': '\u062a\u0642\u0646\u064a\u0627\u062a \u0645\u0646\u0639 \u0627\u0644\u062a\u0635\u062d\u064a\u062d \u0648\u0627\u0644\u062a\u062d\u0644\u064a\u0644 Anti-Debugging \u0648\u0643\u064a\u0641\u064a\u0629 \u0627\u0644\u0627\u0644\u062a\u0641\u0627\u0641 \u0639\u0644\u064a\u0647\u0627', 'id': 7342613638451460232}, {'title': '\u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a \u0648\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062d\u064a\u0629 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Process Hacker \u0648 Procmon', 'id': 9192776043197913210}, {'title': '01 - \u0645\u0642\u062f\u0645\u0629 \u0634\u0627\u0645\u0644\u0629 \u0641\u064a \u0627\u0644\u0647\u0646\u062f\u0633\u0629 \u0627\u0644\u0639\u0643\u0633\u064a\u0629 (Reverse Engineering) \u0648\u0623\u0647\u0645\u064a\u062a\u0647\u0627 \u0641\u064a \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a', 'id': 4359312251101816349}, {'title': '\u062a\u062a\u0628\u0639 \u0648\u0645\u0642\u0627\u0631\u0646\u0629 \u062a\u0639\u062f\u064a\u0644\u0627\u062a \u0633\u062c\u0644 \u0627\u0644\u0646\u0638\u0627\u0645 Windows Registry \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Regshot', 'id': 6839091499568043512}]}, {'title': '\u0627\u0644\u062a\u0635\u0646\u064a\u0641\u0627\u062a', 'type': 'Label', 'sectionId': 'sidepar', 'id': 'Label1'}]}]); _WidgetManager._RegisterWidget('_ImageView', new _WidgetInfo('Image002', 'MopileMenuLogo', document.getElementById('Image002'), {'resize': true}, 'displayModeFull')); _WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'logo', document.getElementById('Header1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList1', 'pages', document.getElementById('PageList1'), {'title': 'Pages', 'links': [{'isCurrentPage': false, 'href': 'https://www.xrefs0.com/p/privacy-policy.html', 'id': '1231625788840551535', 'title': 'privacy policy'}, {'isCurrentPage': false, 'href': 'https://www.xrefs0.com/p/terms-conditions.html', 'id': '4018660743722642202', 'title': 'terms \x26 conditions'}, {'isCurrentPage': false, 'href': 'https://www.xrefs0.com/p/contact-us.html', 'id': '560170149590671177', 'title': 'contact us'}, {'isCurrentPage': false, 'href': 'https://www.xrefs0.com/p/about-us.html', 'id': '4541278575456217144', 'title': 'about us'}, {'isCurrentPage': false, 'href': 'https://www.xrefs0.com/p/archives.html', 'id': '6733210844476658035', 'title': 'archives'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull')); _WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList3', 'topsocialL', document.getElementById('LinkList3'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList001', 'menu', document.getElementById('LinkList001'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch2', 'searchform', document.getElementById('BlogSearch2'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML1', 'AddOns', document.getElementById('HTML1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_ContactFormView', new _WidgetInfo('ContactForm200', 'AddOns', document.getElementById('ContactForm200'), {'contactFormMessageSendingMsg': 'Sending...', 'contactFormMessageSentMsg': 'Your message has been sent.', 'contactFormMessageNotSentMsg': 'Message could not be sent. Please try again later.', 'contactFormInvalidEmailMsg': 'A valid email address is required.', 'contactFormEmptyMessageMsg': 'Message field cannot be empty.', 'title': 'contact form', 'blogId': '4702789384463124685', 'contactFormNameMsg': 'Name', 'contactFormEmailMsg': 'Email', 'contactFormMessageMsg': 'Message', 'contactFormSendMsg': 'Send', 'contactFormToken': 'ACvIOeDp2GaAMvzJVRnT30l5G1_D:1787624279019', 'submitUrl': 'https://www.blogger.com/contact-form'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'Tempnec', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/2937099709-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList4', 'sidepar', document.getElementById('LinkList4'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts1', 'sidepar', document.getElementById('PopularPosts1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label1', 'sidepar', document.getElementById('Label1'), {}, 'displayModeFull'));