1. A system, comprising: a hardware processor configured to: initialize, as a copy-on-write overlay associated with an original virtual machine image, a first virtual machine instance, wherein the first virtual machine instance is an overlay of a hierarchy of virtual machine images, and wherein the original virtual machine image comprises the root of the hierarchy; apply a set of one or more modifications to the first virtual machine instance; start the modified virtual machine instance; capture a first set of data resulting from executing a first sample in the modified virtual machine instance; and determine, based at least in part on an analysis of the captured data that the first sample is malicious; and a memory coupled to the processor and configured to provide the processor with instructions.