procdump -ma lsass.exe lsass.dmp
http://live.sysinternals.com/procdump.exe
http://live.sysinternals.com/procdump64.exe