hard20 pts · first answer countsincident-responsecredential-theftlolbins
An LSASS dump with a built-in DLL
You see this command run as SYSTEM on a server. What is the attacker doing and what follows for response?
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 692 C:\Users\Public\d.bin full
Discussion 0
Join free to post in the discussion.
Related questions
- Backups that survive ransomwareCybersecurity Analyst
- Why chain of custody mattersCybersecurity Analyst
- Security event or security incidentCybersecurity Analyst
- What makes malware a trojanCybersecurity Analyst
- Double extortion ransomwareCybersecurity Analyst
- What a rootkit is forCybersecurity Analyst
- What an infostealer takesCybersecurity Analyst
- What fileless malware meansCybersecurity Analyst