An attack content analysis program causing a computer to execute a process including, receiving transmit data including a first program and transmitted, through a second network, to a first machine connected to a first network, transmitting, after initiation of the first program, a read-based instruction for the first machine via a first session established between the computer and a second machine, which is different from the first machine; and executing, after initiation of the first program, a write-based instruction for the first machine on behalf of the first machine.