DLLs in Malware

Read a process by the libraries it loads — what each DLL does, and why it's a flag when the wrong process loads it. Click any name to copy it.

Start here

How to read this

Every DLL here is loaded by legitimate software all day — the signal is context. Watch for a capability DLL in a process that has no business with it (Notepad loading ws2_32), an unsigned DLL, or one loaded from a non-System32 path (side-loading). See loads with tasklist /m, Sysmon Event 7 (ImageLoad), or your EDR — then check the process itself against Core Processes.

Capability

Networking & C2

ws2_32.dllWinsock — raw sockets, the base of nearly all networking. Expected in network apps; a flag inside a document viewer or a dropper.
wininet.dllHigh-level HTTP/FTP (WinINet). The go-to for C2 over HTTP(S). A non-browser process loading this wants to talk to the internet.
winhttp.dllWinHTTP — HTTP for services and background code. Same C2 signal as wininet, minus the browser cache.
urlmon.dllHome of URLDownloadToFile — the classic download-and-run primitive. Rare in benign non-browser code.
dnsapi.dllDNS resolution API. Heavy or odd use points to DNS tunneling / DNS-based C2.
netapi32.dllNet APIs — shares, sessions, SMB. Used for host/user enumeration and lateral movement.
iphlpapi.dllIP Helper — adapters, routes, ARP table. Common in host recon and network discovery.
wininet.dll + urlmon.dllThe pair together in a small unsigned binary is a strong downloader signature.

Capability

Process injection & manipulation

kernel32.dllUbiquitous, but it exports the injection primitives — VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, LoadLibrary. Judge by the imports and the behavior, not the load.
ntdll.dllThe lowest layer — Nt* syscalls. NtUnmapViewOfSection drives process hollowing; direct syscalls here bypass user-mode hooks.
kernelbase.dllWhere many kernel32 functions actually live. Same primitives, one layer down.
psapi.dllProcess enumeration (EnumProcesses, EnumProcessModules) — finding a target to inject into.
user32.dllExports SetWindowsHookEx — used for DLL injection via hooks as well as keylogging.
advapi32.dllTokens and impersonation (AdjustTokenPrivileges, OpenProcessToken) for privilege manipulation.

Capability

Credential access

dbghelp.dllExports MiniDumpWriteDump — the standard way to dump lsass.exe memory for offline credential extraction. dbgcore.dll too.
comsvcs.dllIts MiniDump export is abused via rundll32 comsvcs.dll MiniDump … to dump LSASS with a signed binary (LOLBAS).
vaultcli.dllWindows Vault / Credential Manager access — stored browser and Windows credentials.
samlib.dllSAM database access — local account hashes.
secur32.dll · sspicli.dllSSPI / authentication packages — credential handling and pass-the-hash tooling.
crypt32.dllCertificate store and DPAPI-protected data — used to pull saved secrets and decrypt them.

Capability

Crypto & ransomware

bcrypt.dll · ncrypt.dllCNG crypto — modern AES/RSA. Rapid, heavy use by an unusual process is the mass-file-encryption signature of ransomware.
advapi32.dllLegacy CryptoAPI (CryptEncrypt, CryptGenKey) — older ransomware and crypters use this path.
crypt32.dllAlso carries CryptStringToBinary — a common way to decode base64 payloads at runtime.

Capability

Persistence & config

advapi32.dllRegistry (RegSetValueEx → Run keys) and service creation (CreateService) — two of the most common persistence spots.
taskschd.dllTask Scheduler COM interface — scheduled-task persistence created programmatically.
ole32.dll · oleaut32.dllCOM. Abused for COM hijacking (persistence) and to drive other COM-based tooling.
wbemcomn.dll · fastprox.dllWMI internals — WMI event-subscription persistence and remote WMI execution.

Capability

Input capture & spying

user32.dllSetWindowsHookEx and GetAsyncKeyState — keylogging — plus clipboard access. High-signal in a background process with no UI.
gdi32.dllBitBlt and friends — screen capture / screenshots.
winmm.dllMultimedia (waveIn*) — microphone / audio capture.
avicap32.dllVideo capture — webcam access. Almost never legitimate in a background binary.

Capability

Evasion & anti-analysis

amsi.dllThe Antimalware Scan Interface. Malware patches AmsiScanBuffer in memory to blind script scanning — watch for it being loaded then modified.
ntdll.dllAlso the ETW-patching and unhooking target — tampering here (patched EtwEventWrite) is defense evasion.
kernel32.dllAnti-debug / sandbox checks live here — IsDebuggerPresent, timing via GetTickCount, long Sleep to outwait a sandbox.
wtsapi32.dllSession enumeration — sometimes used to detect analyst sessions or RDP before acting.

Technique

DLL side-loading & hijacking

Instead of importing a capability, malware gets a trusted process to load its DLL. The tell is a legit signed EXE loading an unsigned DLL from its own folder or a user-writable path.

DLL search-order hijackDrop a malicious DLL earlier in the search path than the real one so a legit app loads yours instead.
DLL side-loadingShip a renamed legit signed EXE alongside a malicious DLL it will load by name — the process looks trusted, the DLL isn't.
Phantom DLLThe OS searches for a DLL that doesn't exist by default; plant one there and it gets loaded.
version.dllA top side-loading target — small, commonly imported, easy to stub. Watch it loading from anywhere but System32.
dbghelp.dll · dwmapi.dll · propsys.dllFrequent side-load targets shipped next to a renamed legit binary. Unsigned copies in an app folder are the flag.
cryptbase.dll · secur32.dll · msimg32.dll · edputil.dllOther commonly abused names for side-loading — legit in System32, suspicious anywhere else.

The detection, restated: right DLL name, wrong path or wrong signature, loaded by a process that shouldn't need it. Confirm the loading process and its path, then treat an unsigned system-named DLL outside System32 as guilty until proven otherwise.