Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Read the full analysis on IntelFusions