Createdump.exe Process Memory Dump
This rule detects the execution of `createdump.exe`, a legitimate utility, when it is used to dump process memory. The detection is based on the presence of specific command-line arguments such as '-u', '--full', '-f', '--name', or '.dmp', which are indicative of memory dumping operations. This activity is often associated with attempts to extract credentials or other sensitive information from running processes.
YARA-L
