Supposing we have a malicious .EXE which deletes (using DEL command with cmd) a sensitive system file.
First, common antivirus will analysis the file with signature detection.
Secondly, it will be sandboxed at runtime by the antivirus.
How does the antivirus sandbox it? Does he "trace" it by using a "ptrace like command" on Windows and stop the malicious .EXE from using DEL? Or does it stop the OS from making the associated process and run the malicious .EXE on a tiny virtual machine with a tiny specific OS?