Dump LSASS process in Task Manager without triggering Defender.
Hooks API calls
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlDosPathNameToRelativeNtPathName_U
RtlDosPathNameToRelativeNtPathName_U_WithStatus
SetDlgItemTextW
And changes the file path from C:\Users\<username>\AppData\Local\Temp\lsass.DMP to what ever you specify in the newStr variable.
Update newStr with the new path you want, and update the username in the matchStr variable.
Compiles to a DLL that you can inject into Taskmgr.exe
