HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get HollowsHunter
Package managers
- Chocolatey
choco install hollowshunter
About HollowsHunter
HollowsHunter scans all running processes on a Windows machine and recognises signs of malicious implants: replaced or implanted PE files, shellcode, hooks and in-memory patches. When it finds something, it can dump the suspicious material for further analysis.
It builds on the PE-sieve engine by the same author, and the repository also contains an ETW listener. It suits malware analysts and incident responders checking a live system for code injection.
Strengths
- Scans all running processes in one pass
- Detects hollowing, shellcode, hooks and in-memory patches
- Dumps suspicious implants for analysis
- Built on the PE-sieve engine
Limitations
- Windows only
- Command-line tool that expects some malware analysis knowledge
Details
- Pricing
- FreeFree to download from the public GitHub repository.
- License
- Proprietary
- Developer
- hasherezade
- Platforms
- Windows, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Incident responders checking a live Windows system for injected code
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to HollowsHunter
Compare allSoftware that can replace HollowsHunter for an important use case, and what changes if you switch.
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
PE-sieve is the underlying engine, scanning a single running process for injected PEs, shellcode and hooks and dumping them for analysis.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures across Windows, Linux and macOS rather than only checking injected code.
Similar software
Related functionality, not necessarily a direct replacement.
Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
Autoruns
A Sysinternals utility that shows every program and driver configured to start automatically on Windows.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
