hasherezade/pe-sieve

Health v2 · maintenance only

Adoption not part of the score

3867 stars · 494 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes, inline hooks, and in-memory patches, then dumps the suspicious material for further analysis. It can be built as a standalone EXE or as a DLL with a simple API for integration into other applications, and it produces JSON reports detailing the indicators found.

Use cases

• detect malware running on a windows system
• dump injected pe files and shellcodes from a process memory
• detect process hollowing and reflective dll injection
• find inline hooks and in-memory patches in a running process
• collect malicious material from a live process for malware analysis
• integrate a process scanner into a security tool via dll api
• scan all running processes for suspicious implants

When to choose

• you need to triage a suspicious process on windows and extract its in-memory implants
• you want lightweight, per-process scanning with json reports of indicators
• you need to detect techniques like process hollowing, process doppelgänging, or reflective dll injection
• you want a dll engine you can embed into your own security or incident-response tooling

When to avoid

• you need a cross-platform scanner for linux or macos
• you want a full antivirus with real-time protection rather than an on-demand analysis tool
• you need static file analysis of samples on disk instead of live process memory inspection

Facets

cli-tool · maturity active

security reverse-engineering cli developer-tools security reverse-engineering windows developer-tools windows cli malware-analysis memory-forensics pe-dumper process-scanner hook-detection process-hollowing dll-injection incident-response libpeconv json-reports

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hasherezade/pe-sieve")