A SOC analyst is investigating a Defender for Endpoint incident on a Windows server that shows signs of an in-memory (fileless) attack. The analyst needs to capture the volatile memory contents of a suspicious running process for later forensic analysis, without terminating the process or taking the whole device offline. Which live response action should the analyst use?