LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Createdump.exe

View source

Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)

Dump
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Dump1

EXAMPLE 01T1003

Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.

COMMAND
createdump.exe -n -f {PATH:.dmp} {PID}
USE CASE
Dump process memory contents using PID.
PRIVILEGES
SYSTEM
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\<version>\createdump.exe
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\<version>\createdump.exe
C:\Program Files\Microsoft Visual Studio\<version>\Community\dotnet\runtime\shared\Microsoft.NETCore.App\6.0.0\createdump.exe
C:\Program Files (x86)\Microsoft Visual Studio\<version>\Community\dotnet\runtime\shared\Microsoft.NETCore.App\6.0.0\createdump.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    createdump.exe process with a command line containing the lsass.exe process id

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

bopin@bopin2020