ProcDump

OVERVIEW

ProcDump is a Sysinternals command-line utility, digitally signed by Microsoft, originally built to capture crash dumps of a process during CPU spikes, hangs, or unhandled exceptions. Because it's a trusted, legitimately signed binary that ships as part of an official Microsoft toolset, it's also widely used offensively and defensively to write out an arbitrary process's memory on demand.

In an engagement, its most common offensive use is dumping the LSASS process to a .dmp file, which can then be moved off the host and parsed offline with mimikatz or pypykatz for credential material, avoiding the need to run a credential-dumping tool directly on the monitored endpoint.

USE CASES

Practical use cases

• 01

  Dumping LSASS memory to disk for offline credential extraction, avoiding a direct mimikatz execution on the host.

• 02

  Using a signed Microsoft binary to blend in as a living-off-the-land tool during an authorized assessment.

• 03

  Capturing a crash or hang dump of a custom application to analyze a stability issue found during testing.

• 04

  Triggering dumps on performance-counter thresholds to reproduce an intermittent issue for the client.

QUICK START

When you need a signed, trusted Microsoft binary to capture a process dump (commonly LSASS) for offline analysis instead of running an unsigned credential-dumping tool directly.

1. Confirm the rules of engagement allow dumping LSASS or the target process on this host.
2. Get the ProcDump binary onto the target (download or already present via Sysinternals).
3. Accept the EULA and run it against the target process with full-memory dump options.
4. Move the resulting .dmp file off the host and parse it offline with mimikatz or pypykatz.

procdump.exe -accepteula -ma lsass.exe lsass.dmp

BEFORE YOU RUN IT

What to check before running it