Identifier / Programs / Windows

procdump.exe

Sysinternals process dump utility file version info (xCyclopedia)

LOLBAS Execute 4 Sigma rules name it 4 ATT&CK techniques 2 documented commands 1 known copy with hashes

How procdump.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

-md

Execute T1202 Indirect Command Execution

foobar

-md

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for procdump.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Loads the specified DLL where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created.

procdump.exe -md {PATH:.dll} explorer.exe

Identify

Trips 1 Sigma rule: mediumProcdump Execution by Florian Roth (Nextron Systems)

Execute T1202 Indirect Command Execution User privileges

Loads the specified DLL where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.

procdump.exe -md {PATH:.dll} foobar

Identify

Trips 1 Sigma rule: mediumProcdump Execution by Florian Roth (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for procdump.exe, by Alfie Champion (@ajpc500), at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for procdump.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRenamed ProcDump ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumProcdump ExecutionFlorian Roth (Nextron Systems)

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)

mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)

T1003.001OS Credential Dumping: LSASS Memory

T1036Masquerading

T1036.003Masquerading: Rename Legitimate Utilities

T1202Indirect Command Execution

Is it the real procdump.exe?

file version info and known copies

Original nameprocdump in the file’s header: a renamed copy still carries it

Installed inC:\SysinternalsSuite\

Signed byMicrosoft Corporation

ProductProcDump, Sysinternals - www.sysinternals.com

DescriptionSysinternals process dump utility

1 known copy

10.0 · C:\SysinternalsSuite\procdump.exe · signed by Microsoft Corporation

916cc8d6bf2282ae0d2db587f4f96780af59e685a1f1a511e0b2b276669dc802

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.