LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Procdump.exe

View source

SysInternals Memory Dump Tool

ExecuteAlias: Procdump64.exe
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Loads the specified DLL where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created.

COMMAND
procdump.exe -md {PATH:.dll} explorer.exe
USE CASE
Performs execution of unsigned DLL.
PRIVILEGES
User
OPERATING SYSTEM
Windows 8.1 and higher, Windows Server 2012 and higher
Execute · DLL
EXAMPLE 02T1202

Loads the specified DLL where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.

COMMAND
procdump.exe -md {PATH:.dll} foobar
USE CASE
Performs execution of unsigned DLL.
PRIVILEGES
User
OPERATING SYSTEM
Windows 8.1 and higher, Windows Server 2012 and higher
Execute · DLL
02 / ON DISK

Known paths

no default
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    Process creation with given '-md' parameter

  • IOC

    Anomalous child processes of procdump

  • IOC

    Unsigned DLL load via procdump.exe or procdump64.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Alfie Champion@ajpc500