1. A method of detecting potentially malicious content, comprising: identifying content for inspection; loading a virtual machine for activating the identified content for inspection; the virtual machine, upon detecting an occurrence of an application processing the content on a processor, tracing activity of the processor in order to form trace data, by: a lightweight driver providing: 1) a list of modules being executed by the virtual machine, and 2) the addresses of the memory pages used by the modules; the lightweight driver activating an exploit detection engine (EDE) to accept a page dump of the memory pages used by the modules; and, upon detecting an occurrence of an exception in the trace data by the EDE, the EDE transferring control to an analyzer, the analyzer detecting suspicious activity according to the trace data based on a context of the exception.