How look your malware sandbox?

Very rarely, but occasionally, I have to run actual malware in my sandbox VM to see what it’s doing. The flow is: successful attack – I extract the malware – run it in my sandbox (a VMware instance that mimics our corporate devices, including all naming conventions) – analyze it via Procmon and Wir