Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 835082" data-attributes="member: 32260">There are some possibilities.<ol>
<li data-xf-list-type="ol">WD could detect your sample after the limit of 10 seconds.</li>
<li data-xf-list-type="ol">WD could finish the analysis before 10 seconds and the computer was infected. Next, WD could detect the malware after some time due to postinfection telemetry.</li>
<li data-xf-list-type="ol">WD could detect the sample from another computer at a similar time on Windows E3 or E5 (enterprise editions). These editions allow more comprehensive analysis, including detonation in the sandbox.</li>
</ol>For the poins 1. and 3. , extending the cloud checkup time can be beneficial. But not for the point 2. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" />&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 835082, member: 32260"] There are some possibilities. [LIST=1] [*]WD could detect your sample after the limit of 10 seconds. [*]WD could finish the analysis before 10 seconds and the computer was infected. Next, WD could detect the malware after some time due to postinfection telemetry. [*]WD could detect the sample from another computer at a similar time on Windows E3 or E5 (enterprise editions). These editions allow more comprehensive analysis, including detonation in the sandbox. [/LIST] For the poins 1. and 3. , extending the cloud checkup time can be beneficial. But not for the point 2. :giggle: (y) [/QUOTE]

Verification