
pe-sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
binary-analysisforensicsmalware-analysis+2
3.9k

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Windows tool for dumping malware PE files from memory back to disk for analysis.

Tool to find metadata and hidden information in the documents.

Forensics artefact collection tool for systems running Microsoft Windows