1. A system comprising: an addressable memory; and one or more hardware processors communicatively coupled to the addressable memory, the one or more hardware processors being configured to instantiate one or more virtual machines that are adapted to analyze received content that has been identified as suspicious by the content having a level of likelihood that at least one characteristic identified during inspection of the content indicates a potential presence of malware, the one or more virtual machines being configured to (i) monitor a delay caused by one or more events including, during processing of the suspicious content, an instruction pointer remaining at a specific address in the addressable memory or within a specific address range in the addressable memory that is less than an entire address range-and (ii) determine the suspicious content includes malware when the delay corresponding to the instruction pointer remaining at the specific address or within the specific address range exceeds a first time period.