Oh sure, you could be extra careful and attempt to detect any obfuscation or encrypted payloads that weren’t decrypted. Then there’s the concern that the malware watches for this behaviour and you’ll need to further modify the environment.