1. A method of determining if a program is potentially malware, comprising: executing said program on a real computer system including accessing data stored in a computer system memory; interrupting the execution of the program at a point of interest; in response to interrupting the execution of the program at the point of interest, performing an emulation of at least part of the program using an emulated computer system implemented on the real computer system; during execution of the program within the emulated computer system, when the program attempts to access a unit of data stored in said computer system memory, copying the unit of data from the computer system memory into an emulated memory, and allowing the program to access the unit of data within the emulated computer system, and furthermore during the emulation of the program, monitoring the behavior of the program in order to detect any suspicious behavior; and if any suspicious behavior is detected, determining that the program is potentially malware.