Procdump Invoking LSASS

Question

The timeline for an application crash shows procdump calling to lsass a few times. I say that procdump is running in user space and when the crash happens the user-mode process lsass is called to enumerate debug privileges and create system audit messages for the Event Log. There could even be other functions of creating a dump that needs to use lsass. I've gone through WinInternals which generally supports the idea, but I'm looking for feedback, clarification, or a better explanation.

Answer 1

Crash Timeline: foobar.exe > WerFault.exe > procdump.exe. > lsass.exe

Normally, the kernel's memory dumps are done by WerFault.exe as the SYSTEM account, and procdump is run by the user.
Memory exists in the kernel, and lsass provides access to it via the LSA. Procdump is calling lsass for its core functions. It's running a few checks, like (debug) privileges.

WinInternals definition says lsass is used to send system audits to the event log, and I have these events in the System Log.
Debug privileges are higher than admin, and lsass enumerates permissions. Procdump is run by the user, so lsass has to run to access the kernel.

WinInternals by Russinovich,
Local Security Authority subsystem (LSASS) A user-mode process running the image
%SystemRoot%\System32\Lsass.exe that is responsible for the local system security policy
(such as which users are allowed to log on to the machine, password policies, privileges
granted to users and groups, and the system security auditing settings), user authentication,
----and sending security audit messages to the Event Log.
The Local Security Authority service (Lsasrv—%SystemRoot%\System32\Lsasrv.dll), a library that LSASS loads, implements most of
this functionality.