> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Dynamic Analysis with x64dbg + FakeNet

> Run malware under x64dbg with FakeNet network simulation on Windows VM4.

> [!WARNING]
>
> Start FakeNet-NG on VM4 **before** transferring or running the sample. Never detonate without FakeNet active.

**Pre-flight (do manually on VM4):**

1. Launch FakeNet: `cd C:\Users\tasox\Downloads\fakenet3.5\fakenet3.5 && fakenet.exe`
2. Transfer sample from VM1: `scp -i ~/.ssh/windows_key <sample> analyst@192.168.56.40:C:/samples/`

```
Dynamic analysis of C:\samples\malware.exe:

1. x64dbg debug_init with C:\samples\malware.exe
2. breakpoint_set on suspicious APIs: CreateProcess, VirtualAlloc, WSAConnect, RegSetValue
3. debug_run to execute the sample
4. On each breakpoint hit: register_get_batch to capture CPU state
5. memory_read at addresses pointed to by registers
6. module_list to see what DLLs were loaded
7. stack_get_trace to see call chain
8. If packed: dump_detect_oep to find OEP then dump_module
9. Summarize: execution flow, APIs called, network IOCs from FakeNet, verdict
```

> [!TIP]
>
> After execution, review FakeNet's console log for DNS queries, HTTP requests, and any C2 beaconing patterns. This often reveals the malware family faster than static analysis.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.