hasherezade/hollows_hunter

Health v2 · maintenance only

Adoption not part of the score

2401 stars · 296 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious implants such as replaced or implanted PEs, shellcodes, hooks, and in-memory patches, and dumps them for analysis. It supports filtering targets by PID, name, or creation time, continuous scanning via a loop mode, and ETW-based listening.

Use cases

• scan all running processes for malicious in-memory implants
• detect process hollowing and injected shellcode on Windows
• dump suspicious PE modules from live processes for malware analysis
• continuously monitor a system for memory-based malware
• triage an infected machine during incident response
• filter process scans by PID, name, or creation time

When to choose

• you need to inspect live Windows process memory for injected code or patched modules
• you want to scan many processes at once rather than a single PID like PE-sieve
• you need to extract implants to disk for offline reverse engineering
• you want a lightweight, scriptable CLI for malware triage

When to avoid

• you are on Linux or macOS - it is Windows-only
• you need real-time endpoint protection rather than on-demand scanning
• you want a GUI-based forensic suite
• you need to scan memory dumps offline rather than live processes

Facets

cli-tool · maturity active

security vulnerability-scanning reverse-engineering cli security windows developer-tools windows cli memory-forensics process-scanning pe-sieve anti-malware shellcode-detection process-hollowing etw incident-response malware-analysis

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hasherezade/hollows_hunter")