Executing procdump64.exe remotely using wmic

Asked Nov 19 '21 at 18:13

Active Nov 19 '21 at 18:13

Viewed 200 times

I am trying to generate a dump file using procdump64.exe in Powershell. I need to run the executable remotely using wmic. I am running the following command:

wmic /node:[IP Address] /user:"[DOMAIN/USER]" /password:"[PASSWORD]" process call create "cmd.exe /c U:\procdump64.exe -ma U:\lsass.exe > C:\dump.dmp"

For reference, I have verified that both procdump64.exe and lsass.exe are located at U:\ .

I receive output that says "Method execution successful" with a Return Value of 0.

However, the file that is generated is empty. Can anyone tell me what is wrong with my command?

asked Nov 19 '21 at 18:13

user17459284

PowerShell has access to WMI/CIM directly (i.e., you do not need to use wmic if you have PowerShell). – Bill_Stewart Nov 19 '21 at 18:22
Thanks for the comment! Unfortunately for the specific lab I'm working on I have to use this technique to get practice with it. – user17459284 Nov 19 '21 at 18:36
That doesn't make any sense. Why would you have to use wmic if you have PowerShell? – Bill_Stewart Nov 19 '21 at 19:03

Executing procdump64.exe remotely using wmic

0 Answers0