I am a malware analysis and low-level systems researcher focused on understanding how software operates at the level of processor architecture, operating systems, networks, and program execution.

My current work combines two closely related directions:

• Malware analysis and reverse engineering
• Low-level software and security tooling development

I am particularly interested in understanding malware not only by observing its behaviour, but by reconstructing the internal architecture, execution flow, memory interactions, network communication, and implementation logic behind that behaviour.

• x64 processor architecture
• Assembly and instruction-level execution
• Registers, calling conventions, stack and heap usage
• Control flow and execution state
• Memory addressing and data representation

• Windows architecture and internals
• Processes, threads, handles and synchronization
• Virtual memory and memory protection
• PE loading and execution
• Windows loader mechanisms
• WinAPI and system-level execution

• Network and protocol architecture
• Network service interaction
• Network behaviour of malware
• Protocol-level analysis and traffic reconstruction

• C and C++ systems programming
• Program execution and memory management
• Low-level software architecture
• WinAPI-based development
• Assembly and C/C++ interaction
• Development of security and research tooling

My primary research direction is malware analysis and reverse engineering.

I study malware as a complete execution system, combining static analysis, dynamic analysis and reverse engineering to reconstruct its architecture and behaviour.

Areas of interest include:

• PE structure and Windows executable architecture
• Malware execution chains
• Loaders and staging mechanisms
• Process and memory behaviour
• Persistence mechanisms
• Network propagation and protocol implementation
• In-memory execution
• Evasion and anti-analysis techniques
• Reverse engineering of compiled C/C++ code
• Behavioural reconstruction from low-level evidence
• IOC and behavioural evidence collection
• MITRE ATT&CK mapping
• YARA and Sigma detection engineering

My approach is evidence-driven: observed behaviour is traced back to the underlying implementation whenever possible, allowing the final analysis to connect code → execution → behaviour → evidence → detection.

I am currently developing my practical experience through independent malware research projects.

My main research project is a deep reverse-engineering analysis of WannaCry, covering:

• PE and static analysis
• Windows execution architecture
• x86 reverse engineering
• Ghidra and x64dbg analysis
• Dynamic execution tracing
• Network propagation architecture
• SMB protocol analysis
• Embedded payload staging
• Cryptographic and protocol-related routines
• IOC and behavioural evidence
• MITRE ATT&CK mapping
• YARA and Sigma detection rules
• Behavioural and architectural reconstruction

The project is structured as a complete malware-analysis case study rather than a collection of isolated notes.

The second direction of my work is low-level software development for security research and analysis.

I am interested in developing tools and proof-of-concept implementations that improve understanding of malware behaviour and low-level system mechanisms.

Current areas include:

• C/C++ systems development
• Assembly
• Windows API programming
• PE and executable-format research
• Memory manipulation and process execution
• Reverse-engineering support tooling
• Malware-analysis utilities
• Detection-oriented tooling
• Proof-of-concept implementations of low-level techniques

The goal is to combine understanding of low-level software architecture with practical security research.

My broader research interests include:

• Malware architecture and execution models
• Windows internals
• Reverse engineering
• Low-level software architecture
• Network protocol implementation
• Malware propagation mechanisms
• Memory and process internals
• Detection engineering
• Security tooling development
• Implementation-specific malware detection
• Relationship between software architecture and observable behaviour

My long-term goal is to become a Malware Analyst / Malware Researcher, specialising in Windows malware analysis, reverse engineering, and low-level threat research.

At this stage, I am focused on gaining as much practical experience as possible.

I am open to:

• Malware analysis opportunities
• Reverse-engineering projects
• Security research
• Junior or trainee positions
• Research collaborations
• Practical projects with security teams
• Opportunities to contribute to malware-analysis or detection engineering work

I am particularly interested in connecting with companies and researchers working with malware analysis, reverse engineering, threat research, and security tooling.

My priority is to continue developing through real-world analysis and engineering work while building a strong body of reproducible technical research.

A complete research case study covering static analysis, deep reverse engineering, dynamic validation, network propagation, behavioural reconstruction, IOC collection, MITRE ATT&CK mapping, and YARA/Sigma detection.

Repository: https://github.com/lerawhite/wannacry-analysis

I prefer to understand systems from the bottom up.

Rather than treating malware behaviour as a black box, I try to reconstruct the mechanisms responsible for that behaviour — from machine instructions and memory operations to operating-system mechanisms, network protocols, and complete execution chains.

The objective is to turn reverse-engineering observations into reproducible technical evidence, architectural understanding, and practical detection mechanisms.