PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get PE-sieve
Other download sites
Run by third parties, not by hasherezade. Prefer the official page above when it works.
About PE-sieve
PE-sieve scans a given process for signs of malicious implants: replaced or injected PE files, shellcode, hooks and in-memory patches. When it finds one, it dumps the modified code so it can be analysed further.
It is used by malware analysts and incident responders to find code hidden in the memory of a live process. It runs from the command line and can also be built as a DLL for use by other tools.
Strengths
- Detects process hollowing, injected PEs, shellcode and hooks
- Dumps suspicious code for later analysis
- Usable as a command-line tool or a DLL
Limitations
- Windows only
- Output assumes familiarity with malware analysis
Details
- Pricing
- FreeFree and open source.
- License
- BSD-2-Clause
- Developer
- hasherezade
- Platforms
- Windows, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Malware analysts and incident responders examining live Windows processes
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to PE-sieve
Compare allSoftware that can replace PE-sieve for an important use case, and what changes if you switch.
HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants.
HollowsHunter scans all running processes in one pass for hollowing, shellcode and hooks, built on the same PE-sieve engine but broader in scope.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures across Windows, Linux and macOS, though it is not open source.
Similar software
Related functionality, not necessarily a direct replacement.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
YARA
Pattern-matching engine for identifying and classifying malware samples.
