PE-sieve scans a given process, searching for the modules containing in-memory code modifications. When found, it dumps the modified PE. Detects inline hooks, hollowed processes, Process Doppelgänging etc. Can be used for unpacking malware.

Process Dump is described as 'Dumps memory components from specific processes or from all processes currently running. Supports creation and use of a clean-hash database, so that dumping of all the clean files such as kernel32.dll can be skipped' and is a process monitoring tool in the development category. There are three alternatives to Process Dump for Windows, Linux, Python and Mac. The best Process Dump alternative is PE-sieve, which is both free and Open Source. Other great apps like Process Dump are LiveDump and PyMemoryEditor.
PE-sieve scans a given process, searching for the modules containing in-memory code modifications. When found, it dumps the modified PE. Detects inline hooks, hollowed processes, Process Doppelgänging etc. Can be used for unpacking malware.

A pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python.
