Start here
Reverse engineering a malware sample: a practical introduction
The static analysis pipeline in the order analysts actually use it: file identification, import table, strings, control flow, decompilation. Plus how to tell when static analysis has stopped paying and it is time to let the sample run.
Windows API behaviour
What CreateRemoteThread tells you about a binary
The classic process injection primitive: the four-call sequence that makes it conclusive, the legitimate software that injects too (your antivirus, for one), and how to confirm intent from cross-references instead of from the import alone.