If you are looking to do a more hands on manual analysis of malicious software, it can involve a variety of tasks, some simpler than others. These efforts can be grouped into stages based on the nature of the associated malware analysis techniques. This cannot always be observed, but in many scenarios you have an opportunity to perform manual investigation
You can start with fully automated analysis which will be the easiest. This is what is normally done by using various tools to analyze the situation and then provide the best method of resolving the issue. It will resolve the issue, but leaves little room for more attention or use of anything more analytically ideal.
When taking a closer look at the suspicious file might proceed by examining its static properties. Such details can be obtained relatively quickly, because they don’t involve running the potentially-malicious program. Static properties include the strings embedded into the file, header details, hashes, embedded resources, packer signatures, meta data such as the creation date, etc.
Looking at static properties can sometimes be sufficient for defining basic indicators of compromise. This process also helps determine whether the analyst should take closer look at the specimen using more comprehensive techniques and where to focus the subsequent steps. Analyzing static properties is useful as part of the incident triage effort.
A behavior analysis can also help when observing, Behavioral analysis involves examining how sample runs in the lab to understand its registry, file system, process and network activities.