LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Dump64.exe

View source

Memory dump tool that comes with Microsoft Visual Studio

Dump
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Dump1

EXAMPLE 01T1003.001

Creates a memory dump of the LSASS process.

COMMAND
dump64.exe {PID} out.dmp
USE CASE
Create memory dump and parse it offline to retrieve credentials.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\dump64.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    As a Windows SDK binary, execution on a system may be suspicious

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

mr.d0x@mrd0x