IOC: createdump.exe process with a command line containing the lsass.exe process id
Dump
Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.
createdump.exe -n -f dump.dmp [PID]
Usecase: Dump process memory contents using PID.
Privileges required: SYSTEM
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1003