Windows Analysis VM with VMware

Windows Analysis VM with VMware

Prerequisites

• Host machine with 16GB+ RAM, 100GB+ free disk
• VMware Workstation Pro (Windows/Linux) or VMware Fusion (macOS)
• Windows 10/11 ISO

Step 1: Create VM

1. File → New Virtual Machine → Custom
2. Guest OS: Windows 10 x64
3. Memory: 4GB+ (8GB recommended)
4. Processors: 2+ cores
5. Network: Host-only
6. Disk: 60GB, single file

Step 2: Critical Settings

• Options → Shared Folders: Disabled
• Options → Guest Isolation: Disable drag-and-drop AND copy-paste
• Hardware → Network Adapter: Host-only

Step 3: Install Windows

Install Windows 10/11 and complete initial setup.

Step 4: Pre-Install Safety Settings (FLARE-VM Requirements)

Disable the following Windows Defender features before installing FLARE-VM:

• Real-time protection
• Cloud-delivered protection
• Automatic sample submission
• Add C: to the exclusion list

Step 5: Install FLARE-VM

Use the same FLARE-VM install script as the VirtualBox guide.

Step 6: Snapshot

1. VM → Snapshot → Take Snapshot
2. Name: Analysis-Ready-Clean

VMware-Specific Tips

• Use vmrun CLI for automated snapshot management
• VMware has better hardware passthrough for USB analysis devices
• Unity mode should NEVER be used during malware analysis