One Day Sec

What other Windows system DLLs beside comsvcs.dll contain MiniDump-related exports?

The automated scan described in the article found that **dbghelp.dll** also exports `MiniDumpWriteDump` and `MiniDumpReadDumpStream`, and various **SOS.dll** files (from .NET Framework) export `MinidumpMode`. The scan identified multiple copies of comsvcs.dll in the winsxs directory as well. This shows that attackers could potentially use dbghelp.dll for similar purposes. The PowerShell script used to find these is available on GitHub and is similar to techniques used in memory dumping via .NET assemblies.
dbghelp.dllSOS.dllMiniDumpWriteDumpexport function scanningWindows DLLscomsvcs.dll

Browse all Q&A →