hollows_hunter
A process scanning tool that detects and dumps malicious implants, shellcodes, hooks, and memory patches in running processes.
A process scanning tool that detects and dumps malicious implants, shellcodes, hooks, and memory patches in running processes.
Checked October 2026.
hollows_hunter is a process scanning tool that analyzes all running processes on a system to identify potentially malicious implants and modifications.
The tool detects various types of malicious activities including:
Built on the PE-sieve library, hollows_hunter provides automated scanning capabilities to identify processes that have been compromised or modified by malware. The tool can dump detected malicious implants for further analysis.
The scanner operates by examining process memory structures and comparing them against expected patterns to identify anomalies that may indicate malicious activity. It supports recursive cloning for development and is available through multiple distribution channels including direct releases and package managers like Chocolatey.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about hollows_hunter: features, pricing and alternatives.
hollows_hunter is a product in the Malware Analysis category. It covers PE File, Shellcode and Memory Forensics.
hollows_hunter is free. Download and setup instructions are at https://github.com/hasherezade/hollows_hunter/.
Alternatives to hollows_hunter listed on CybersecTools:
Compare all hollows_hunter alternatives at https://cybersectools.com/alternatives/hollowshunter
hollows_hunter is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Deep learning-based malware analysis & threat contextualization platform.
Fast disassembler producing reassemblable assembly code using Datalog
Tool for fingerprinting malware HTTP requests.
Falcon Sandbox is a malware analysis framework that provides in-depth static and dynamic analysis of files, offering hybrid analysis, behavior indicators, and integrations with various security tools.
A collection of Python scripts that automate tasks and extend IDA Pro disassembler functionality for reverse engineering workflows.
ILSpy is the open-source .NET assembly browser and decompiler with various decompiler frontends and features.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
