ntdll.dll: the genuine NT Layer DLL, and how malware abuses it without replacing it

What ntdll.dll does, and why attackers care about it

ntdll.dll is the NT Layer DLL. When a program opens a file, reserves memory, creates a thread or starts another process, the request goes through the familiar Windows libraries such as kernel32.dll and ends in ntdll.dll, whose Nt and Zw functions make the actual system call into the kernel. The file also contains the loader that sets up every new process and loads its DLLs, the heap manager and the code that dispatches exceptions. Windows maps it into each process from System32 (or SysWOW64 for 32-bit programs) before the program's own code runs.

That position makes ntdll.dll the last stop before the kernel, and so the place where security software watches. Many endpoint protection products place hooks on ntdll.dll functions inside each process, so they see when a program writes into another process's memory or starts a thread in it. Attackers know this, which is why ntdll.dll appears in so many malware reports.

Malware uses it in three ways, none of which touches the file on disk. It calls the native functions directly, for example NtAllocateVirtualMemory, NtWriteVirtualMemory and NtCreateThreadEx, to inject code into another process. It removes the security hooks by loading a clean copy of ntdll.dll from disk and overwriting the hooked code in its own memory, or skips the library entirely with direct system calls. And it reads function addresses straight from the loaded ntdll.dll to hide which functions it uses.

Replacing ntdll.dll on disk would gain an attacker nothing and would risk an unbootable PC: the file is protected by Windows, signed by Microsoft and checked by System File Checker. So a genuine ntdll.dll on your PC is the normal case even when the PC is infected, and a second file with this name somewhere else is the real warning sign.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' ntdll.dll from a fake copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell and Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies. Copies in C:\Windows\WinSxS belong to Windows' own component store and are also normal. Every other path is not Windows' ntdll.dll.

   Get-ChildItem C:\ -Recurse -Filter ntdll.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says NT Layer DLL, Microsoft Corporation, and a Windows version such as 10.0.26100. It is about 2 MB; a much smaller or larger file with this name is not Windows' copy. A fake can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means it is not Microsoft's file.

   Get-AuthenticodeSignature 'C:\path\to\ntdll.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which copy a process loaded. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type ntdll.dll and press Search. Every process lists it, and every path should be System32 or SysWOW64. A process that shows another path deserves a close look.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the 823 known Microsoft builds. A match proves the file is Microsoft's, wherever it was found.
6. Scan and repair. Run Microsoft Defender's full scan, then the offline scan if a detection comes back. If the copy in System32 or SysWOW64 does not match a Microsoft build, run sfc /scannow from an administrator Command Prompt to restore it.

These checks look at the file on disk. Malware that patches ntdll.dll in memory leaves the file untouched, so a genuine file does not prove the PC is clean. For that, rely on Microsoft Defender's full and offline scans, and on the warning signs below.

Warning signs and what they mean

Documented malware that used ntdll.dll

MITRE ATT&CK lists ntdll.dll's native functions under Native API (T1106). The reports below describe malware that called them or read them directly. In each case the genuine file stayed in place; the malware used the copy loaded in memory.

None of these replaced ntdll.dll on disk. Checking the file tells you it is genuine; finding the program that misused it is a job for Microsoft Defender's full and offline scans.

Everyday problems with ntdll.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

ntdll.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 823 Microsoft builds in total are known.

Questions people ask