Process Explorer course

Using the DLL View in Process Explorer

Learn how to use Process Explorer DLL View to inspect executable images, DLLs, mapped data files, paths, publishers, and module load activity.

Process Explorer’s DLL View shows the files mapped into the virtual address space of a selected process. It is useful for troubleshooting, understanding application dependencies, and investigating unfamiliar components loaded during execution.

This lesson assumes basic knowledge of Windows processes, files, folders, and full filesystem paths. For broader Process Explorer guidance, see the Process Explorer course.

What DLL View Shows

A DLL, or Dynamic Link Library, is a separately stored file containing compiled code that Windows applications can load and reuse. A shared library can provide common functions to many applications, such as cryptography, user-interface features, or file handling.

Using shared libraries avoids embedding a separate copy of common functionality into every application. This can reduce duplicated code, allow components to be updated independently, and let multiple programs use the same operating-system or vendor-provided features.

In Process Explorer, DLL View exposes files mapped into the selected process’s process address space. A process address space is the virtual memory range where that process maps its executable code, libraries, and data.

• The process’s primary executable image is listed.
• Loaded DLL modules are listed.
• Mapped data files may also appear, so the list is not limited to executable libraries.

An executable image is the primary executable file associated with a process. A module is any loaded executable image, DLL, or other mapped file shown in the module list.

Opening and Closing DLL View

1. Select the target process in the upper process pane.
2. Press Ctrl+D to switch the lower pane to DLL View.
3. Inspect the module list displayed in the lower pane.
4. Press Ctrl+L to close or hide the lower pane when finished.

The lower pane belongs to the currently selected process. Selecting a different process changes the modules shown in DLL View to match that process.

Automatic Updates and Change Highlighting

Process Explorer refreshes displayed module information according to its configured automatic refresh interval. The exact time before a change appears depends on that setting.

These colors help you observe runtime module activity. For example, keep DLL View open while opening a dialog, importing a file, or enabling an optional feature. Green entries can reveal components loaded only for that action. A module that appears briefly and then becomes red may be a temporary dependency, plug-in, or diagnostic component.

Sorting and Organizing the Module List

DLL View columns can be sorted, resized, and reordered. Use the column headers to sort the list, drag column boundaries to change widths, and rearrange columns so the information most useful to your investigation is visible.

• Sort by Name to find a particular DLL or compare similarly named files.
• Sort by Company Name to group modules by publisher.
• Sort by Path to find modules outside normal Windows or application installation directories.

Sorting by path is especially useful when looking for files in user-writable folders, temporary directories, application data locations, or network-related locations.

DLL View Column Reference

Descriptions and company names are file metadata: information embedded in or associated with a file. Metadata is useful for investigation, but it is not proof that a file is trustworthy. A malicious or incorrectly labeled file can contain misleading metadata, and a legitimate file may have incomplete metadata.

Inspecting an Individual Module

Right-click a module in the lower pane to access investigation actions.

Properties

Properties opens the selected file’s Properties dialog. Review its location and available file details, including version information, publisher information, and other metadata.

Search Online

Search Online opens a search for the selected DLL or mapped file in the system’s default browser. Search results can help identify a vendor, product, plug-in, or known compatibility issue. Treat online search results as investigation aids rather than conclusive evidence.

Check VirusTotal

Check VirusTotal uses the file’s hash, a calculated fingerprint for a particular file version, to look up reputation and multi-engine scan information. VirusTotal is an online file and hash analysis service. A detection can justify deeper analysis, but a clean result does not prove that a file is safe, and an isolated detection can be a false positive.

Practical Examples

Identify a Standard Windows DLL

1. Select a running process and press Ctrl+D.
2. Locate a module such as cryptbase.dll.
3. Review its Description, Company Name, and full Path.
4. Check whether a path under C:\Windows\System32 is consistent with an expected Windows component.

The path is important because a familiar filename in an unexpected directory deserves more scrutiny than the same filename in an expected system location.

Observe Modules Loaded by a Feature

1. Open DLL View for the application.
2. Perform an action that may load an optional feature, such as opening a dialog or importing a file.
3. Watch for green-highlighted entries after the next refresh.
4. Sort the list or inspect the new entries to determine which files were loaded.
5. Record the module name, publisher, description, and path for comparison.

Find Modules from Nonstandard Locations

1. Sort the DLL list by Path.
2. Review files loaded from application folders, user profile directories, temporary folders, or network-related locations.
3. Compare each location with the application’s expected installation directory and approved plug-ins.
4. Use Properties and reputation checks for files that do not have an obvious explanation.

Investigate an Unfamiliar Module

1. Select the unfamiliar DLL in the lower pane.
2. Open Properties to inspect its file details and location.
3. Use Search Online to research the filename and publisher.
4. Use Check VirusTotal to assess the file hash’s reputation.
5. Escalate for deeper investigation when the location is surprising, publisher information is absent or inconsistent, or reputation results are suspicious.

Interpreting DLL View During Troubleshooting and Security Review

Use module names, publishers, and paths together. No single field is sufficient to classify a module as expected or malicious.

• A known vendor, expected product directory, and behavior consistent with the application generally support a legitimate explanation.
• A familiar filename in a temporary or user-writable directory should be investigated rather than accepted based on its name.
• A publisher that does not match the application, an unusual path, and suspicious reputation findings together increase the need for review.
• Green and red entries can connect module activity with a specific application action.

Troubleshooting Patterns

A DLL Name Is Unfamiliar

• Check the full Path instead of relying on the filename alone.
• Open Properties to inspect file information.
• Search for the module online.
• Check its hash with VirusTotal.

An Application Loads a Module Only During a Specific Action

• Keep DLL View open while reproducing the action.
• Use green highlighting to identify newly loaded files.
• Record the module name, path, publisher, and description.
• Repeat the action to determine whether the same module appears consistently.

A Module Appears in an Unexpected Location

• Sort by Path and compare the location with expected Windows or application installation directories.
• Inspect Properties and reputation information.
• Determine whether the module is an approved add-on, a dependency installed by another product, or an item requiring escalation.

A Module Disappears Shortly After Appearing

• Use red highlighting to recognize the unload event.
• Repeat the triggering action to confirm the load/unload pattern.
• Correlate the activity with application features, plug-ins, or diagnostic operations.

Exam-Relevant Notes

• DLL View displays mapped files for the currently selected process, not a system-wide list of every DLL.
• The list can include the process executable, DLLs, and mapped data files.
• Ctrl+D opens or switches the lower pane to DLL View.
• Ctrl+L hides or closes the lower pane.
• Green indicates newly loaded modules; red indicates recently unloaded modules.
• Name is only the filename; Path is the complete filesystem location.
• Properties, Search Online, and Check VirusTotal support investigation but do not independently prove trust or malware.

For related Process Explorer features, see Process Properties, Process Explorer keyboard shortcuts, and DLL View tabs.