Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Read the full analysis on IntelFusions