The answer is complete for the questioner's #2, but let's dig a little-deeper into #1.
There are other ways to analyze malware which implements anti-virtualization, vm-detection, sandbox detection, and sandbox evasion techniques. However, does the malware also include environmentally-keyed detection or evasion techniques, such as the ones outlined here -- https://www.vmray.com/blog/sandbox-evasion-techniques-part-4/ -- (aka context-aware malware aka environment-sensitive)?
Cuckoo is an excellent sandbox for features and behavior extraction, so it's not always wise to jump to windbg or other classic bare-metal debugging (although sometimes it is wise to do this). If the built-in cloaking solution for Cuckoo, vmcloak, can prevent the malware from detecting or evading it then you still get all of the benefits of Cuckoo.
Some of these can be elicited early-on during static analysis or even during simple Yara triage. There are also advanced ways of performing Yara triage that will catch malicious processes in-the act, such as Godaddy's procfilter -- https://github.com/godaddy/yara-rules/blob/master/features/virtualbox_detection.yara
If you use dynamic analysis to elicit the sandbox detection, evasion, or context-aware malware techniques, be sure to know your limitations. makin is a good starting framework to determine those anti-debugging capabilities.
A lot of this depends on your goal with malware. What do you want to know about them; what questions do you have? Do you need to extract Proactive Threat Indicators for internal-only blacklists or will you be sharing them? Do you need to deconfig RATs that are operating on systems in your network? For example, a focus on nation-state RATs might warrant a jump to the -- https://github.com/ctxis/CAPE -- tool or similar.
If you want a simple solution to scaling sandbox-based automation with stealth functionality that surpasses vmcloak, check out -- drakvuf.com
I am definitely interested in more of the bare-metal techniques (especially the AMT RAM cloner!) spoken to by @ekse in the primary answer. These are also very-valuable! However, just because you have bare metal doesn't mean that context-aware malware techniques such as time bombs, logic bombs, and specifically-targeted malicious logic won't be an additional problem -- you'll have to account for them!