A Sysmon-based helper script for dynamic malware analysis, inspired by Noriben.
Katsudon installs a dedicated Sysmon profile, collects detailed Sysmon telemetry while your sample runs, and, on Ctrl+C exports the log to a TSV before restoring (or uninstalling) Sysmon.
Its key advantage is that it surfaces Process Access events (Event ID 10)—calls such as WriteProcessMemory, VirtualAllocEx, and others that can be overlooked in typical Procmon-based workflows.
That said, the resulting TSV is noticeably busier than Noriben’s streamlined Procmon output and can be a bit harder to scan at a glance.
- Python 3.12 (older 3.x should also work)
- Sysinternals Sysmon v15+ in your
%PATH%(tested with Sysmon64 v15.15)
- Place
katsudon.pyandsysmon_config.xmlin the same folder. - Double-click
katsudon.pyor launch it from Command Prompt / Windows Terminal.
- FLARE-FakeNet-NG – a user-mode network simulator that simplifies traffic capture and redirection during dynamic analysis.