Research questionHow can ransomware analysis adaptively select modalities to reduce cost and latency without losing detection and family-attribution accuracy?Applying static, dynamic, and memory analysis to every sample can waste computation and delay verdicts. The central difficulty is deciding when additional evidence is necessary without weakening ransomware detection or family attribution.