# Noriben > Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM. - Type: Tool - Targets: Binary - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-11-05 - Added to the catalog: 2026-11-06 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/noriben/index.md) ## Requirements & limits - **Prerequisites:** Python 3 and Sysinternals procmon.exe or procmon64.exe on the Windows analysis machine; yara-python is optional for --yara scans and requests for VirusTotal lookups. Release at review: 2.1.0, published 2026-11-03, whose tag is the reviewed main commit. - **Scope:** The README's sandbox workflow runs a sample in a VM, copies the results off and reverts before the next sample. NoribenSandbox.py starts a predefined VM snapshot, copies in the sample, runs Noriben and retrieves a ZIP report and a screenshot; the README says this front end currently runs on macOS hosts. - **Limits:** With a VirusTotal API key it looks up file hashes; uploading every created file to VirusTotal happens only when virustotal_upload is set to True in Noriben.config, which defaults to False. - **Testing evidence:** The 2.1.0 notes add large-scale unit testing, developed with AI assistance; the README runs tests/unit_tester.ps1 through Noriben in a Windows VM with Procmon module loads enabled. - **License:** Apache-2.0 per the README and LICENSE. ## Primary sources 1. 2. 3. 4. 5. ## More in Native binaries - [QEMU](https://awesomerea.org/resources/qemu/index.md) · Tool - [Hex Fiend](https://awesomerea.org/resources/hex-fiend/index.md) · Tool - [ScyllaHide](https://awesomerea.org/resources/scyllahide/index.md) · Tool - [YARA-X](https://awesomerea.org/resources/yara-x/index.md) · Tool - [ReClass.NET](https://awesomerea.org/resources/reclass-net/index.md) · Tool - [Keypatch](https://awesomerea.org/resources/keypatch/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.