If you're just playing with script kiddie stuff and not ridiculous zero days, an up to date virtual machine should be just fine, make sure to keep your VM up to date. VM breaking malware is actually quite rare and usually patched quickly - this is the same stuff that keeps cloud providers safe where anyone can execute arbitrary code in a VM on their systems, if it's good enough for them, it's probably good enough for you, just make sure it has no access to your network.

VM detecting malware however is exceedingly common: plan to have to bypass basic VM detection, minimal knowledge of reverse engineering should make that pretty easy.

If you want/need to allow it access to the internet for dynamic analysis or botnet monitoring, I'd suggest looking into setting up a separate VM to route all the traffic over Tor or a commercial VPN provider and allowing it access only via that VM. This way if you manage to piss off any script kiddies you won't be the one who gets DDoS'd.

Nothing is perfect and if you're serious about this consider separate hardware, but if you're not quite that paranoid this setup is highly workable.