1

enter image description hereI'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.

Improve this question
4
  • What / where are you disassembling / data ? The disassembly looks invalid ins outs etc are dos era instructions and wouldnt be valid in a 64 bit user mode app
    – blabb
    Jun 2 at 6:30
  • What does it mean and how did it happen?
    – Invulnerable Immortal
    Jun 3 at 9:04
  • @InvulnerableImmortal you are in the DOS stub. If you convert the bytes to ascii it reads 'This program cannot be run in DOS mo'...
    – Paweł Łukasik
    Oct 31 at 18:09
  • Unfortunately you don't state it in your question, but looking at the output I'll go by the assumption you're using Windows 11. No: shell32.dll is a so-called known DLL. Unless loaded with a fully qualified path, the official shell32.dll will be mapped to the process by the loader essentially. There is a "preloaded" (by the session manager) global section object available for each of the known DLLs - two sets exist on systems with WOW64 - in \KnownDlls and \KnownDlls32 respectively. You could see them in WinObj or HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs.
    – 0xC0000022L ♦
    Oct 31 at 21:34

1 Answer 1

Reset to default
1

As i commented the area you are disassembling does not look like a valid code

As to how did it happen you should know better you have provided the address for disassembling 0x7ffc6b54000 and that address is probably located in advapi32.dll's resource section in the virtual address space of the process

Improve this answer
1
  • I just thought that it was something different. I actually don't know anything, I'm new to this.
    – Invulnerable Immortal
    Jun 19 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.