All Detections

Process Memory Dump Via Comsvcs.DLL

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025017

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Sigma