Createdump.exe

Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)

Dump

Dump process memory contents using PID.

createdump.exe -n -f {PATH:.dmp} {PID}

Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process. — MITRE: T1003 — Privileges: SYSTEM