.. /Createdump.exe
Star

Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)


Paths:

Resources:
Acknowledgements:

Detection:

Dump

Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.
createdump.exe -n -f dump.dmp [PID]
Usecase: Dump process memory contents using PID.
Privileges required: SYSTEM
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1003