LetMeowIn - Analysis of a Credential Dumper

ARC Labs analyzes LetMeowIn, a Windows LSASS credential-dumping tool that leverages MiniDumpWriteDump with in-memory manipulation and multiple evasion techniques (API obfuscation, indirect syscalls, ETW tampering, hijacking existing LSASS handles via NtDuplicateObject, and corrupting dump signatures) to bypass endpoint security; the report confirms the tool can dump LSASS while EDRs are present and provides practical detection recommendations including process creation and Sysmon monitoring, handle-manipulation auditing, registry SACLs for MiniDumpAuxiliaryDlls, and heuristics for dump file creation.