Loading malware…
SharpDump is a C# port of PowerSploit’s Out-Minidump.ps1 functionality and is used to dump LSASS process memory on Windows for credential access. The provided content places it among LSASS dumping tools validated against Elastic’s tool-agnostic “LSASS Memory Dump Handle Access” detection rule, alongside ProcDump, Mimikatz, and comsvcs. Its observed behavior is consistent with requesting handles to \Windows\System32\lsass.exe using access rights commonly associated with memory dumping, reflected in Windows Security Event ID 4656 and access masks such as 0x1fffff, 0x1010, 0x120089, and 0x1F3FFF, as well as access descriptions including READ_CONTROL and Read from process memory. The activity maps to MITRE ATT&CK Credential Access (TA0006), OS Credential Dumping (T1003), specifically LSASS Memory (T1003.001). The content does not attribute SharpDump to a specific threat actor or industry targeting, and no unique SharpDump-specific IoCs are provided beyond its association with suspicious LSASS handle access.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SharpDump is a C# tool for dumping process memory, often used to extract credentials from LSASS for further attacks.
Tool used to dump LSASS process memory, enabling credential harvesting from Windows systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.