Compare the ImageBase from PE Explorer (on disk) with the loaded base address in a memory dump. Any mismatch > 0x10000 suggests process hollowing (common in malware).
While not a full-blown debugger like IDA Pro, the built-in disassembler in Version 2 has been updated to recognize the x64 instruction set, allowing users to trace entry points and function calls in 64-bit code. pe explorer 64bit version 2