1. A computer-implemented method for behavior monitoring, comprising: loading, by a virtual machine monitor (VMM), a first code section of a target program into a first memory page allocated to a virtual machine (VM); injecting, by the VMM, a second code section into the target program by changing an address at which the target program executes from a first address to a second address, the first address being a location of the first code section and the second address being a location of the second code section, wherein the second code section includes a plurality of Instructions directed toward detecting a first type of malware, wherein the second code section is injected via execution of an injection thread while one or more threads processing a content specimen are paused; and determining the content specimen is suspicious when an anomalous behavior of the content specimen is detected according to execution of the injected second code section, wherein the second code section is injected after the target program and the content specimen have been loaded within the VM.