A method and system for accelerating malware emulator by using an
accelerator. The accelerator allows for a potentially malicious component
(i.e., process) containing dummy processes to be executed in a real CPU
of a computer system using its operating memory. A special memory area is
allocated for the process based on the memory requested by the process in
the emulator. The state of the CPU and the memory is loaded in the
emulator prior to executing the suspicious process. The system can be
restored to its initial state in case of malicious actions performed by
the process. The dummy instructions of the process are processed by the
CPU at its own speed and as soon as the process performs a malicious
instruction it is stopped by the emulator. The emulation process is
accelerated to a speed of a regular CPU.