LSASS Dump via VSLauncher

Kaung Khant Ko@kaungkhantko

•updated May 24, 2026•2•0•517

Detects a process access or memory dumping event indicative of MiniDumpWriteDump against LSASS originating from VSLauncher.exe. This behavior is highly anomalous and has been observed by UAC-0184 via DLL sideloading of the PassMark Endpoint DLL (input.dll) for credential theft.