1. A computerized method to determine whether an object is part of a malicious attack, comprising: detecting, by a virtual machine being executed by hardware circuitry, an event that has occurred during an analysis of the object, the event comprising an anomalous behavior of the object during execution of the object within the virtual machine, and the virtual machine includes a guest virtual system and a host virtual system; dynamically altering at least an instrumentation of a virtual device within the host virtual system of the virtual machine by the hardware circuitry based on information associated with the event, the dynamic altering of the instrumentation of the virtual device comprises changing an instrumentation of the virtual device of the virtual machine from a first instrumentation of the virtual device to a second instrumentation of the virtual device while preserving a state of the virtual device as perceived by the guest virtual system, wherein the second instrumentation of the virtual device being different from the first instrumentation of the virtual device; and determining based on at least the event, whether the object is part of a malicious attack.