Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list)
This is just an excerpt (full list: http://pastie.org/8560797):
0x5b860000 netapi32.dll
FileObject @8a3cb028, Name: \WINDOWS\system32\netapi32.dll
0x77f60000 shlwapi.dll
FileObject @8a3e0df0, Name: \WINDOWS\system32\shlwapi.dll
As you can see there is a shlwapi.dll loaded in the process.Thanks to DependencyWalker (looking at the imports of services.exe) I found out how shlwapi.dll is loaded. ( -> means imports )
netapi.dll -> dnsapi.dll -> iphlpapi.dll -> mprapi.dll -> setupapi.dll -> shlapi.dll
But only netapi.dll is loaded. dnsapi.dll is not loaded, there is no entry for it in the InLoadOrder module list, neither is any of the other dlls from the from the above "dependency chain" loaded.
This is not only for shlapi.dll but for many other dll's that are loaded as well. For example: shell32.dll, psapi.dll... Neither does this only happen for services.exe process.
Any ideas why these dlls are loaded into the process?
Any help is most appreciated, regards!