“`html

When you’re analyzing a malware specimen, you likely execute it in a debugger and establish several breakpoints. The concept is to seize control of the program prior to it carrying out “noteworthy” actions. Typically, breakpoints are placed on memory allocation API calls (such as VirtualAlloc()) or process functions (like CreateProcess(), CreateRemoteThread(), …).

“`