LSASS dumps

While doing threat hunting I noticed an LSASS dmp file, don't really have a lot to go on other than the device and IP are both authorized machines. Is there any legitimate reason somebody would create that dump file? I know its not a good sign but just trying to rule it out as malicious, just curious if any sysadmins or something could jump in and fill me in. Thanks in advance!

cybersecurity lsass