# ProcessAnalyzer

## ProcessAnalyzer

Repo: [https://github.com/GL1T0H/ProcessAnalyzer](https://github.com/GL1T0H/ProcessAnalyzer)

PowerShell script for detailed process analysis, including network connections, file hashes, and threat intelligence.

<figure><img src="https://private-user-images.githubusercontent.com/98574213/444448154-a89fd1ea-6eec-4edb-a1c5-47cd741c6d0b.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NDg5ODg1MzIsIm5iZiI6MTc0ODk4ODIzMiwicGF0aCI6Ii85ODU3NDIxMy80NDQ0NDgxNTQtYTg5ZmQxZWEtNmVlYy00ZWRiLWExYzUtNDdjZDc0MWM2ZDBiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTA2MDMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUwNjAzVDIyMDM1MlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNjNjYwNjNhMDRiYzBlNzIzOTgwNzIxYmUyNThlYWZhZDBlMjgyM2NjY2M0MTUxZGExNzNhZjQzMzA4ZjViMDUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.suzBfcQeKA-BcvewZKjwigFdvx7tCjsXEwLLCYtqjww" alt=""><figcaption></figcaption></figure>

### Features

* Analyzes process by ID or name
* Retrieves process details: path, hash, parent process, user, and command line
* Checks file hash with VirusTotal
* Queries AbuseIPDB and GeoIP for remote IPs
* Lists loaded DLLs
* Sends report via Telegram
* Optional HTML report export

### Requirements

* PowerShell 5.1+
* Internet access for API queries
* API keys for VirusTotal, AbuseIPDB
* Telegram bot token and chat ID

### Usage

.\ProcessAnalyzer.ps1 -ProcessId \[-ExportHtml]

.\ProcessAnalyzer.ps1 -ProcessName \[-ExportHtml]

### Setup

1. Clone the repository: git clone [https://github.com/GL1T0H/ProcessAnalyzer.git](https://github.com/GL1T0H/ProcessAnalyzer.git)
2. Update API keys and Telegram settings in the script:

* $TelegramBotToken = "YOUR\_TELEGRAM\_BOT\_TOKEN"
* $TelegramChatID = "YOUR\_CHAT\_ID"
* $AbuseIPDBApiKey = "YOUR\_ABUSEIPDB\_API\_KEY"
* $VirusTotalApiKey = "YOUR\_VIRUSTOTAL\_API\_KEY"

3. Run the script with appropriate parameters.

### Example

`.\ProcessAnalyzer.ps1 -ProcessId 1234 -ExportHtml`

`.\ProcessAnalyzer.ps1 -ProcessName notepad`

### Output

* Telegram message with formatted report
* Optional HTML report saved to $env:TEMP\ProcessReport\_.html

### Notes

* Replace placeholder API keys before use.
* Ensure proper error handling for API failures.
