A machine-implemented method for selectively performing malware analysis of objects residing in a computer system, the method comprising: assigning, by the computer system, an initial trust status to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level; based on the trust status, associating, by the computer system, the first object with an event type to be monitored, wherein the event type is selected from among: (a) essential events, occurrence of which is informative as to trust status evaluating for an object, and (b) critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code; monitoring, by the computer system, occurrences of events relating to the first object wherein: in response to the first object being assigned the relatively higher trust level, only the essential events are monitored; and in response to the first object being assigned the relatively lower trust level, the critical events are monitored; in response to an occurrence of a monitored event relating to the first object, determining, by the computer system, a need for performing malware analysis of the first object based on the trust status of the first object and the event type, such that: in response to a detected occurrence of a critical event as a result of the monitoring, malware analysis of the first object is to be performed; and in response to a detected occurrence of an essential event as a result of the monitoring, malware analysis of the first object is to be performed if the trust status of the first object is the relatively lower trust level, and malware analysis of the first object is not to be performed if the trust status of the first object is the relatively higher trust level; and in response to determination of the need for performing the malware analysis, either performing, or forgoing, by the computer system, the malware analysis for the first object. assigning, by the computer system, an initial trust status to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level; based on the trust status, associating, by the computer system, the first object with an event type to be monitored, wherein the event type is selected from among: (a) essential events, occurrence of which is informative as to trust status evaluating for an object, and (b) critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code; monitoring, by the computer system, occurrences of events relating to the first object wherein: in response to the first object being assigned the relatively higher trust level, only the essential events are monitored; and in response to the first object being assigned the relatively lower trust level, the critical events are monitored; in response to the first object being assigned the relatively higher trust level, only the essential events are monitored; and in response to the first object being assigned the relatively lower trust level, the critical events are monitored; in response to an occurrence of a monitored event relating to the first object, determining, by the computer system, a need for performing malware analysis of the first object based on the trust status of the first object and the event type, such that: in response to a detected occurrence of a critical event as a result of the monitoring, malware analysis of the first object is to be performed; and in response to a detected occurrence of an essential event as a result of the monitoring, malware analysis of the first object is to be performed if the trust status of the first object is the relatively lower trust level, and malware analysis of the first object is not to be performed if the trust status of the first object is the relatively higher trust level; and in response to a detected occurrence of a critical event as a result of the monitoring, malware analysis of the first object is to be performed; and in response to a detected occurrence of an essential event as a result of the monitoring, malware analysis of the first object is to be performed if the trust status of the first object is the relatively lower trust level, and malware analysis of the first object is not to be performed if the trust status of the first object is the relatively higher trust level; and in response to determination of the need for performing the malware analysis, either performing, or forgoing, by the computer system, the malware analysis for the first object.