Although traditional anti-virus software is fast, feature code based detection mode will be a restriction. Dynamic analysis based on sandbox is better at finding malware via software behavior. It can not only find malware for client but also help malware analyzer working faster. In purpose of increasing usability and efficiency of analysis based on sandbox, a malware dynamic analysis cloud is designed and implemented. Through distributed control mechanism, we can ensure the system's capability and flexibility. A malicious software can be distinguished based on the result of the analysis. Experiments show the system can effectively detect malware behavior with high efficiency.