ProcDump
Sysinternals: dumps a process's memory (LSASS) to extract credentials offline.
A Sysinternals tool that dumps a process's memory to a file. Its typical use is dumping LSASS legitimately (Microsoft-signed, evades some AV) to extract credentials offline with mimikatz or pypykatz.
Family Credential dumping & theft
Flags -accepteula -ma lsass.exe
Concepts Dumping credentials from LSASS (Mimikatz)
Cheatsheet Post-exploitation & lateral
Installation
# Sysinternals (Microsoft-signed: usually passes AV). Upload procdump.exeUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- HeistHackTheBox