Guide / Wizard

Wizard reference

The configuration wizard is the first screen shown when SysAnalyzer launches. Fields are persistent — settings are saved to cfg.dat on close and restored on next launch.

If SysAnalyzer is launched on Vista or later without elevation, it auto-relaunches elevated. If UAC is unavailable and the user is not a local admin, the wizard shows a banner indicating reduced functionality.

SysAnalyzer Configuration Wizard with Tools menu cascaded open
The wizard with the Tools menu open. The Options frame on the right holds the live-logging toggles; the textboxes at the bottom of the frame configure RWE Scan and Monitor Dlls.

Target binary

FieldPurpose
ExecutablePath to the file under analysis. Accepts EXE, DLL, and any registered shell-handler extension (DOC, PDF, HTML, JS, etc). Also accepts pid:NNNN to attach the API logger to an existing process. Drag-and-drop is supported.
ArgumentsCommand-line arguments passed to the executable. For shell-handled file types (PDF, DOC…), put the viewer in Executable and the file path here. Drag-and-drop is supported.
Delay (secs)Seconds to wait between launching the target and taking Snapshot 2. Default 30.

Below each path, a status label shows compile date and PE type (32/64-bit, .NET, etc) for sanity checking.

DLLs: SysAnalyzer can launch DLLs directly via the bundled loadlib.exe (32-bit) or x64Helper.exe (64-bit). Just point Executable at the DLL.

Options panel

Live-logging toggles

OptionEffect
Use Api LoggerInject api_log.dll into the target at launch and stream API calls into the Api Log tab. Right-click the "?" label to read a stability note.

Right-click the option label to toggle dll-name randomization (a "- R" suffix appears on the caption when active). Useful when the sample checks for api_log.dll by name.
Use SniffHitLaunch sniff_hit.exe in the background to record HTTP/DNS/IRC traffic.
Full Packet CaptureLaunch win_dump.exe to capture full packets to capture.log (or capture_N.log) on the desktop.
Use Directory WatcherStart file-system monitoring at launch. Modified files are auto-copied into [analysis]\DirWatch\ for later inspection.

Network options

OptionEffect
Interface Indexlibpcap interface index for windump. Click the "?" to spawn win_dump.exe -D in a console showing all interface indices on the host.
IPThe IP of the chosen interface (auto-populated; only shown when more than one interface is available).
filter for host only trafficRestrict the capture filter to ip src [host] or ip dst [host]. Generally on, unless you are looking at a sample that spoofs source addresses.
Ignore IPAppend and not (ip src X or ip dst X) to the capture filter. Use to drop noise from a known-uninvolved IP (e.g. an analyst workstation).

Process options

OptionEffect
Start Browser as Inject TargetLaunches a "goat" browser window before the target, giving injectors something stable to attach to. Started during wizard load (not on Start) so the browser has time to settle before the snapshot.
Monitor Dlls inComma-separated process-name fragments. SysAnalyzer takes a DLL snapshot for any running process whose path contains one of these substrings. explore matches both explorer.exe and iexplore.exe. Use * to monitor every process. Double-click the label to restore defaults (explore,svchost,firefox,rundll).
RWE ScanComma-separated process-name fragments. After the second snapshot, these processes get scanned for RWE memory regions even if the malware did not spawn them — useful for catching injection into pre-existing host processes.
Run As Another UserLaunch the target under a non-admin account. Username dropdown is auto-populated from local accounts.
  • Not compatible with the API logger.
  • Credentials are validated before execution.
  • Cannot launch via shell-handler extensions (PDF, DOC…) — the target must be a directly-executable EXE or DLL.

Known File DB

Checking Use Known file DB filters the displays in the main UI to hide files the database has marked as trusted. The label next to the checkbox shows DB state: Loaded, Empty, or Not found. Click build now to populate the database. See Known File DB.

Buttons and links

ControlAction
StartValidate inputs, launch live-logging components, take Snapshot 1, launch the target, start the countdown.
SkipSkip launching anything; jump straight to the main UI with a base snapshot taken. Use this for live-system inspection or when you want to drive snapshots manually.
ToolsPopup menu (see below).
Help fileOpen this help file (CHM).
AboutVersion info.

Tools menu

Available from the Tools button on the wizard. These actions do not require a target binary and are useful for ad-hoc inspection of the running system.

ItemAction
Scan Processes for DLLPrompt for a DLL name; lists every running process that has it loaded.
Scan Procs for Unknown DllsSame scan, but reports only DLLs not present in the Known File DB. Disabled if the DB is empty.
RWE Memory Scan AllScan every running process for RWE-marked memory regions. Results in a viewer; double-click any region to dump it.
RWE Memory Scan OneSame scan, single process selected from a picker.
String Memory ScanOpen the deep memory scanner (see Memory tools).
Open Saved AnalysisBrowse to an existing analysis folder and open it in the Report Viewer.
Kill All LikePrompt for a name fragment; terminate every process whose path matches (case-insensitive substring). The wizard process itself is excluded.
External → SniffhitLaunch sniff_hit.exe standalone.
External → ProcWatchLaunch proc_watch.exe standalone.
External → Api LoggerLaunch the standalone API-logger UI (no target required; can attach by PID).
External → DirWatchLaunch the standalone directory-watcher UI.
External → Command PromptOpen cmd.exe elevated (caption shows "32bit Elevated" on Vista+).
External → Run As Trusted InstallerSpawn a shell as TrustedInstaller for inspecting protected paths.
External → Edit Hosts FileOpen C:\Windows\System32\drivers\etc\hosts in Notepad.

Configuration storage

Wizard state is persisted to two locations:

Saved on every wizard exit (Start or Skip or close). To reset to defaults, delete cfg.dat.