ProcDOT
A visual malware analysis tool that correlates system activity logs into interactive process and network behavior graphs.
ProcDOT is an open source malware and behavior analysis tool developed by Christian Wojner. It is designed to correlate multiple system monitoring data sources into a single interactive visualization, enabling analysts to understand complex malware behavior, process relationships, and network activity at a glance.
ProcDOT is commonly used by malware analysts, DFIR teams, and reverse engineers to investigate suspicious executables, sandbox output, and post infection activity.
First time seeing this?
What ProcDOT Does
ProcDOT ingests and correlates logs from system monitoring tools such as Process Monitor (Procmon), network captures, and custom event traces. It then generates an interactive graph that visually represents process execution, file operations, registry access, and network communication.
By transforming raw logs into behavioral graphs, ProcDOT helps analysts quickly identify malicious execution chains, parent child relationships, dropped files, registry persistence, and command and control activity.
Key Features of ProcDOT
Behavior Graph Visualization
Converts raw monitoring logs into interactive process and activity graphs.Process Relationship Mapping
Displays parent child relationships between processes.File System Activity Correlation
Visualizes file creation, modification, deletion, and access events.Registry Activity Analysis
Highlights registry keys and values accessed or modified by processes.Network Activity Integration
Correlates processes with IP addresses, domains, and network connections.Log Correlation Engine
Merges multiple data sources into a unified behavioral view.Interactive Filtering and Zooming
Enables analysts to focus on specific processes or behaviors.Malware Focused Workflow
Optimized for analyzing suspicious binaries and sandbox results.Exportable Visual Output
Supports exporting graphs for reporting and documentation.
Advanced Use Cases
Malware Behavior Analysis
Understand how malware executes, spreads, persists, and communicates.
Sandbox Output Analysis
Analyze dynamic analysis results from malware detonation environments.
Incident Response
Visualize attacker executed processes and their downstream effects.
Threat Hunting
Identify abnormal execution chains and unexpected system behavior.
Reverse Engineering Support
Gain behavioral context before or during static analysis.
Latest Updates (as of 2026)
Recent status and maintenance highlights include:
Continued community usage in malware research workflows
Compatibility with modern Procmon and log formats
Ongoing use in academic and training environments
Stable core functionality with limited feature changes
Continued relevance for behavioral visualization use cases
ProcDOT remains a niche but valuable tool for analysts who rely on visual correlation during malware investigations.
Why It Matters
Malware often produces thousands of low level events that are difficult to interpret in isolation. ProcDOT provides clarity by visually connecting actions to processes and outcomes.
For analysts, it significantly reduces investigation time and improves understanding of complex malicious behavior.
Requirements and Platform Support
ProcDOT runs on:
Windows
It requires:
Process Monitor logs or compatible system activity logs
Java Runtime Environment
Optional network capture data for correlation
Official repository and documentation:
https://github.com/woj-ciech/ProcDOT