pe-sieve — authorized process memory scanning

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

pe-sieve (hasherezade/pe-sieve) scans running Windows processes for suspicious PE images and can dump them for offline review. Release v0.4.1.1 (2025-09-13 UTC) was the latest non-prerelease on 2026-10-24. License is BSD-2-Clause. Use it only on hosts and processes you may examine.

On this page

Snapshot

FieldValue
LicenseBSD-2-Clause
Latest checkedv0.4.1.1 (2025-09-13 UTC)
JobLive process PE implant / hollowing detection + dump
Stars (order of magnitude)~3.9k on GitHub (counts change daily)
Typical next stepOpen dumps in PE-bear / Ghidra; correlate with capa

Allowed framing

  • Incident-response hosts under ticketed authorization.
  • Malware lab VMs you administer.
  • Teaching detection concepts with your test implants in a sandbox.

Scope we will not cover

  • No injector / hollowing / process-doppelgänging cookbooks.
  • No “bypass EDR with pe-sieve tips” framing.
  • No remote scanning of systems without authorization.

Beginner path (authorized only)

  1. Work inside an isolated Windows lab VM with snapshots.
  2. Install from official hasherezade/pe-sieve Releases.
  3. Target a PID you are allowed to inspect; save dumps next to case hashes.
  4. Triage dumps with PE-bear and Detect It Easy.
  5. For memory-first IR, also see Volatility 3.
Which to pick
  • Use pe-sieve for authorized live process PE anomaly checks.
  • Pair dumps with static triage tools before drawing conclusions.
  • Never treat detection success as permission to scan arbitrary machines.

For legal, authorized and educational use only.

FAQ

What is pe-sieve?

pe-sieve is a tool that scans a running process for suspicious PE modules (for example implanted or hollowed code) and can dump findings for offline analysis.

Which version is cited?

v0.4.1.1 published 2025-09-13 UTC on hasherezade/pe-sieve Releases (latest non-prerelease checked 2026-10-24).

Is pe-sieve open source?

Yes. GitHub reports BSD-2-Clause for hasherezade/pe-sieve (checked 2026-10-24).

Can I scan arbitrary coworker machines?

Only systems and processes you are authorized to examine under IR policy or written consent.

Does this teach writing process injectors?

No. Detection and dumping of authorized lab/IR targets only — topic plan excludes malware writing.

Sources