1

enter image description hereI'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.

4
  • What / where are you disassembling / data ? The disassembly looks invalid ins outs etc are dos era instructions and wouldnt be valid in a 64 bit user mode app
    – blabb
    Jun 2, 2023 at 6:30
  • What does it mean and how did it happen? Jun 3, 2023 at 9:04
  • @InvulnerableImmortal you are in the DOS stub. If you convert the bytes to ascii it reads 'This program cannot be run in DOS mo'... Oct 31, 2023 at 18:09
  • Unfortunately you don't state it in your question, but looking at the output I'll go by the assumption you're using Windows 11. No: shell32.dll is a so-called known DLL. Unless loaded with a fully qualified path, the official shell32.dll will be mapped to the process by the loader essentially. There is a "preloaded" (by the session manager) global section object available for each of the known DLLs - two sets exist on systems with WOW64 - in \KnownDlls and \KnownDlls32 respectively. You could see them in WinObj or HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs.
    – 0xC0000022L
    Oct 31, 2023 at 21:34

1 Answer 1

1

As i commented the area you are disassembling does not look like a valid code

As to how did it happen you should know better you have provided the address for disassembling 0x7ffc6b54000 and that address is probably located in advapi32.dll's resource section in the virtual address space of the process

1
  • I just thought that it was something different. I actually don't know anything, I'm new to this. Jun 19, 2023 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.