1. A system, comprising: a processor configured to: copy an original virtual machine image to a RAM disk, wherein the original virtual machine image corresponds to a base installation of a first operating system; create a plurality of copy-on-write overlays, wherein a first overlay and a second overlay included in the plurality of copy-on-write overlays are associated with installation of a respective first application and second application on top of the original virtual machine instance, wherein the first application and second application are different; initialize a first virtual machine instance as a copy-on-write overlay of the first copy-on-write overlay, wherein any changes to the first virtual machine will be captured in a first copy-on-write overlay file; start the first virtual machine instance, and execute a sample inside the first virtual machine instance; initialize a second virtual machine instance as a copy-on-write overlay of the second copy-on-write overlay, wherein any changes to the second virtual machine will be captured in a second copy-on-write overlay file; start the second virtual machine instance, and execute the sample inside the second virtual machine instance; determine, based at least in part on an analysis of the first copy-on-write overlay file and the second copy-on-write overlay file, that the sample acts maliciously when executed in the first virtual machine instance, and that the sample does not act maliciously when executed in the second virtual machine instance; and a memory coupled to the processor and configured to provide the processor with instructions.