ProcDump

ProcDump is a legitimate Microsoft Sysinternals memory-dump utility that is widely abused by threat actors for credential access and related post-exploitation activity. Across the provided reporting, its most common malicious use is dumping the memory of lsass.exe to obtain credentials, hashes, tickets, and other secrets for lateral movement, privilege escalation, and follow-on compromise. Reported command lines include variants such as "procdump.exe -accepteula -ma lsass.exe lsass.dmp", "%ALLUSERSPROFILE%\p.exe -accepteula -ma lsass.exe C:\ProgramData\xxx.zip", and "procdump64.exe -ma lsass.exe". Actors frequently rename the binary to evade detection, with observed names including pr.exe, pr64.exe, mpms.exe, and p.exe, and one report cited placement as c:\windows\system32\prc64.exe.

The content also documents ProcDump being used beyond LSASS dumping. In one ToddyCat case, attackers used Sysinternals ProcDump to dump the running Outlook process to extract Microsoft 365 OAuth tokens after browser-based token theft was blocked. The tool is repeatedly described as part of broader hands-on-keyboard intrusions and ransomware or espionage operations.

Threat actors and groups explicitly associated with ProcDump use in the content include Kimsuky, APT33, APT39, FIN13, Elephant Beetle, PARINACOTA, Lazarus/Andariel-related activity, ToddyCat, FamousSparrow, and operators in Everest and other ransomware-linked intrusions. Additional reporting references its use in campaigns involving compromised IIS servers, VMware Horizon exploitation, phishing-led domain compromise, and exploitation of public-facing applications.

Observed victim environments and targets include Windows systems generally, domain controllers, backup servers, IIS web servers in South Korea, finance and commerce organizations in Latin America, telecommunications and travel organizations, energy providers, hotels, government and military networks, and enterprise Microsoft Exchange or Microsoft 365 environments.

Detection-relevant indicators in the content focus on LSASS access and dump creation rather than the tool name alone. Reported telemetry includes Windows Security Event ID 4656 handle requests to \Windows\System32\lsass.exe with suspicious access masks such as 0x1fffff, 0x1010, 0x120089, and 0x1F3FFF; Sysmon Event ID 10 for LSASS access; Sysmon Event ID 11 for creation of lsass*.dmp files; and call traces involving dbghelp. Because ProcDump is a legitimate administrative tool, defenders should expect adversaries to abuse renamed copies and blend usage into normal administration.