Dump64.exe

Creates a memory dump of the LSASS process.

Use Create memory dump and parse it offline to retrieve credentials.

dump64.exe {PID} out.dmp

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Dump

MITRE

T1003.001

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dump64.yml

IOC: As a Windows SDK binary, execution on a system may be suspicious

Refs

twitter.com/mrd0x/status/1460597833917251595

lolbas-project.github.io/lolbas/OtherMSBinaries/Dump64/