To provide a specimen to be analyzed in priority based on the specimen or the degree of dishonest of a terminal related to this specimen.

A program analysis system 1 for analyzing a specimen receives information about a specimen, which is a suspicious program detected by a terminal 5, mail server 6, a WEB server 7 or the like, and information about the terminal 5 relating to the specimen. Based on analyzed recommended information DB including a combination of an analysis recommended condition and the degree of analysis recommendation, the system 1 determines an analyzing order list 29 for the specimen, and analyzes according to the analyzing order list 29 whether the specimen is a dishonest program or not. If the specimen satisfies a predetermined applying condition, the system 1 creates a specimen analysis device analyzing recommended information 49 based on a predetermined analysis recommended rule, and updates the analyzed recommended information DB by using the specimen analysis device analyzing recommended information 49.