Uses DInvoke from TheWover to invoke dynamically MiniDumpWriteDump function and dump LSASS process memory.
It also uses DInvoke for calling all the Native APIs needed. Dump is directly processed from memory to a compressed file to minimize detection using a callback function in MiniDumpWriteDump thanks to callback code in https://github.com/ricardojoserf/lsass-dumper-csharp
It is necessary to have SeDebugPrivilege. You can use basic scripts from pwshSeDebug.
.\DMiniDumpWrite
Dump file is saved to dump.dmp.gz
Dump file can be processed with pypykatz:
pypykatz lsa minidump dump.dmp
It is also recommended to protect the assembly with ConfuserEx tool to avoid signature detection.