createdump.exe

Microsoft .NET Runtime Crash Dump Generator file version info (xCyclopedia)

LOLBAS Dump 2 Sigma rules name it 3 ATT&CK techniques 1 documented command 2 known copies with hashes

How createdump.exe is abused

documented by LOLBAS

Dump T1003 OS Credential Dumping

-n

-f

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for createdump.exe.

1 documented command

from LOLBAS, each read by the identifier

Dump T1003 OS Credential Dumping SYSTEM privileges

Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.

createdump.exe -n -f {PATH:.dmp} {PID}

Identify

Trips 1 Sigma rule: highCreateDump Process Dump by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for createdump.exe, by mr.d0x, Daniel Santos, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for createdump.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highCreateDump Process DumpFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highRenamed CreateDump Utility ExecutionFlorian Roth (Nextron Systems)

T1003OS Credential Dumping

T1003.001OS Credential Dumping: LSASS Memory

T1036Masquerading

Is it the real createdump.exe?

file version info and known copies

Original nameFX_VER_INTERNALNAME_STR in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\5.0.11\
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.11\

Signed byMicrosoft Corporation

ProductMicrosoft .NET, Microsoft Corporation

DescriptionMicrosoft .NET Runtime Crash Dump Generator

2 known copies

5,0,1121,47308 @Commit: f431858f8b1f1510723ace6343786c9194dbd7fc · C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\5.0.11\createdump.exe · signed by Microsoft Corporation

a29e03863f41cd76a9bbd7aa878e2fefc8be9c4d6e5c07d70b41e002ff66051e

5,0,1121,47308 @Commit: f431858f8b1f1510723ace6343786c9194dbd7fc · C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.11\createdump.exe · signed by Microsoft Corporation

c9e266c931c28d27ef0fa654c069f1b56339a818492245d15046d883b309b8b6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.