PE-sieve is a lightweight process scanner that detects and dumps malicious implants including replaced or injected executables, shellcode, hooks, and in-memory patches.
The tool addresses the need to identify runtime malware modifications within a single process. It works by scanning process memory to recognize specific attack patterns such as inline hooks, Process Hollowing, Process Doppelgänging, and Reflective DLL Injection. The scanner can extract detected malicious material for offline analysis. PE-sieve is built as a minimal engine focused on single-process analysis rather than system-wide scanning, and it can be deployed either as a standalone executable or as a DLL with an exposed API for integration into other applications.
Developers should choose this tool when they need to analyze individual processes for memory-based malware indicators. It suits malware analysis workflows, incident response scenarios, and integration into security applications that require programmatic access to process scanning capabilities. For broader system monitoring across multiple processes simultaneously, the related HollowsHunter tool builds on PE-sieve's engine to provide full-system scanning. For malware unpacking specifically, MalUnpack offers that specialized functionality on top of the same foundation.
The project maintains active discussion channels for questions beyond its FAQ documentation. Development activity shows consistent attention to the codebase with regular updates addressing both bug fixes and feature enhancements. The tool is distributed through multiple package managers, indicating ongoing maintenance and compatibility with current systems.
