How to do a user process memory dump from a kernel mode driver?

To intercept process creation I use PsSetCreateProcessNotifyRoutineEx and get the PID, PEPROCESS. Tell me, how can I dump these processes? Can’t find related information

Not the answer you want, but the way to do this is to have a service that uses MiniDumpWriteDump to create the process dump.

Another way is to cause an unhandled exception in that process and let Dr Watson do it for you. In modern Windows Dr Watson has been renamed Windows Error Reporting and a few registry keys are needed along with enough disk space to make this work. I won’t tell you how to cause an unhandled exception in the target process

That results in a crash. The dump api does not do that.

I guess I made the assumption that that’s what is wanted, but yes, it will crash the process and collect a dump post facto. And you can collect a dump without doing that.