1. A system comprising: one or more counters; comparison logic; and one or more hardware processors communicatively coupled to the one or more counters and the comparison logic, the one or more hardware processors being configured to instantiate one or more virtual machines that are adapted to analyze received content, the one or more virtual machines being configured to monitor a delay caused by one or more events conducted during processing of the content and identify the content as including malware if the delay exceed a first time period.