Poll the target until it becomes suspended by the dump operation. Immediately open WerFaultSecure (PROCESS_SUSPEND_RESUME) and call NtSuspendProcess to freeze the dumper. The researcher also published ...