The reason I extracted a PE file in my last diary entry, is that I discovered it was the dropper of a Cobalt Strike beacon @DebugPrivilege had pointed me to. My 1768.py tool crashed on the process memory dump. This is fixed now, but it still doesn’t extract the configuration.
Article Link: 1768.py's Experimental Mode - SANS Internet Storm Center